Clean at the same secdb levels: openssl 3.5.8-r0/3.5.9-r0, busybox 1.37.0-r31, ncurses, icu-libs.
Action: refresh these images (same change set as the digest-pinning work in the audit's image census:
pull the current build, pin tag@sha256:…, restart one service at a time) — the pins are what make the
"fixed in" answer reachable again.
**Severity:** n/a (Alpine secdb carries no severity field); fixes published.
| Package | Installed in images | Fixed at | Images carrying it |
|---|---|---|---|
| musl | 1.2.6-r2 | 1.2.6-r3 | [CVE-2026-107891](https://secdb.alpinelinux.org/v3.24/main.json) in gitea-server, grafana, pihole (alpine 3.24.1) and gitea-postgres, authentik-postgres, searxng-valkey, ntfy, frank-tts (alpine 3.24.2) |
| libssl3 | 3.5.7-r0 | 3.5.8-r0 | CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 in gitea-server, grafana, pihole |
Clean at the same secdb levels: `openssl 3.5.8-r0`/`3.5.9-r0`, `busybox 1.37.0-r31`, `ncurses`, `icu-libs`.
**Action:** refresh these images (same change set as the digest-pinning work in the audit's image census:
pull the current build, pin `tag@sha256:…`, restart one service at a time) — the pins are what make the
"fixed in" answer reachable again.
Source: [vuln-dankclaw.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankclaw.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Digest refresh pass for the eight Alpine-carrier images queued in serverAppConfigs right after the observability deploy lands: pull current builds, pin tag@sha256:, restart one service per deploy window.
**Taking ownership (agent).** Digest refresh pass for the eight Alpine-carrier images queued in serverAppConfigs right after the observability deploy lands: pull current builds, pin `tag@sha256:`, restart one service per deploy window.
Pin pass landed (serverAppConfigs PR #74, merged): every Alpine-carrier quadlet on Dankclaw now pulls today's build pinned by digest (gitea, grafana, pihole, both postgres, valkey, searxng, open-webui, gluetun, lightpanda + the dankserver/frankbook carriers). The rebuild can no longer move under a service - and the next vuln scan grades a fixed digest, not a tag. Whether the musl/libssl3 rows actually clear depends on upstream rebuilding on the patched Alpine; the scan re-grades them now that the coordinate is stable. Ask: re-run the scanner after the next audit window; this closes when it reports clean.
**Pin pass landed** (serverAppConfigs PR #74, merged): every Alpine-carrier quadlet on Dankclaw now pulls today's build **pinned by digest** (gitea, grafana, pihole, both postgres, valkey, searxng, open-webui, gluetun, lightpanda + the dankserver/frankbook carriers). The rebuild can no longer move under a service - and the next vuln scan grades a fixed digest, not a tag. Whether the musl/libssl3 rows actually clear depends on upstream rebuilding on the patched Alpine; the scan re-grades them now that the coordinate is stable. Ask: re-run the scanner after the next audit window; this closes when it reports clean.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: n/a (Alpine secdb carries no severity field); fixes published.
Clean at the same secdb levels:
openssl 3.5.8-r0/3.5.9-r0,busybox 1.37.0-r31,ncurses,icu-libs.Action: refresh these images (same change set as the digest-pinning work in the audit's image census:
pull the current build, pin
tag@sha256:…, restart one service at a time) — the pins are what make the"fixed in" answer reachable again.
Source: vuln-dankclaw.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Digest refresh pass for the eight Alpine-carrier images queued in serverAppConfigs right after the observability deploy lands: pull current builds, pin
tag@sha256:, restart one service per deploy window.Pin pass landed (serverAppConfigs PR #74, merged): every Alpine-carrier quadlet on Dankclaw now pulls today's build pinned by digest (gitea, grafana, pihole, both postgres, valkey, searxng, open-webui, gluetun, lightpanda + the dankserver/frankbook carriers). The rebuild can no longer move under a service - and the next vuln scan grades a fixed digest, not a tag. Whether the musl/libssl3 rows actually clear depends on upstream rebuilding on the patched Alpine; the scan re-grades them now that the coordinate is stable. Ask: re-run the scanner after the next audit window; this closes when it reports clean.