NetEye Product Security has rated this update as having a high security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.49
26.7.3_neteye1.46.1-1
Summary
This Keycloak update (version 26.7.3) fixes 20 security issues found during internal review. None of them are rated Critical for running systems. The two most serious,CVE-2026-18215 and CVE-2026-18214 (CVSS 8.1), could let an external login provider (Microsoft or Google) bypass the organization/tenant restriction configured for it, potentially letting an account from outside the allowed company or domain log in. Another issue, CVE-2026-18571(CVSS 7.2), could let a delegated administrator assign a user to groups they aren’t supposed to manage. The remaining issues are lower-severity gaps in permission checks and edge cases in login/authorization handling, with limited practical impact on their own. There is no evidence of active exploitation of any of these issues.
For details on how to apply this update, refer to the NetEye Update Section in the User Guide.
Asset Management: GLPI agent inventory submissions through satellites now work with the glpiinventory plugin On NetEye satellites, nginx proxies GLPI inventory submissions from agents to the GLPI instance running on the master. Until now, the proxy covered only one endpoint, Read More
NagVis: honor recognize_services and exclude_members for Icinga DB hostgroups When NagVis renders a hostgroup summary object, two map options control which member states may influence the icon: recognize_services: if disabled, only the host states matter for the group icon; exclude_members: Read More
Important: Grafana security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the grafana packages are now available for NetEye 4. Security Fix for NetEye 4.50 12.4.13_neteye3.31.5-1 CVEs CVE-2026-15577CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2026-33374CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-93294CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Read More
RKE2: Fix of the upgrade to NetEye 4.49 and NetEye 4.50 fresh installations During an upgrade to NetEye 4.49 or a fresh installation of NetEye 4.50, the configuration of the RKE2 service could cause PCS to report all *_virt_ip resources Read More
Graph titles no longer disappear We fixed an issue where graph titles on ICW2 dashboards disappeared a few seconds after the page loaded.Graph titles now remain visible as expected. List of updated packages To solve the issue mentioned above, the Read More
