Disclaimer: Three of the security issues referenced below do not yet have public CVE identifiers, so they are referenced by their GHSA ID. This post will be updated as soon as CVEs become available. Important: Icinga Web 2 security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic…
Read MoreDisclaimer: Some of the CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available. Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Elasticsearch Kibana Logstash Logstash shares the two eMudhra trust-store CVEs listed under Elasticsearch (CVE-2026-91403, CVE-2026-114820) through its…
Read MoreUpdate: Elastic Stack v9.5.6 also includes important security fixes. You can find more details here. Update of Elastic Stack to Version 9.5.6 Elastic Stack 9.5.6 is a maintenance release that brings a large set of stability, correctness and hardening fixes across Elasticsearch, Kibana, Fleet Server, Logstash, Elastic Agent, Beats, Elastic Observability, and Elastic Security. Elasticsearch…
Read MoreDisclaimer: The security issues below do not yet have publicly disclosed CVE identifiers, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available. Important: GLPI security update Type/Severity NetEye Product Security has rated this update as…
Read MoreDisclaimer: The security issues referenced below do not yet have publicly disclosed CVE identifiers, so they are referenced by GHSA ID. This post will be updated as soon as CVEs become available. Important: Icinga 2 security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic An update for the icinga…
Read MoreDisclaimer: The CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not available at this time. This post will be updated as soon as additional information becomes publicly available. Update: The CVEs referenced below have now been publicly disclosed, and additional details have been…
Read MoreAsset Management: GLPI agent inventory submissions through satellites now work with the glpiinventory plugin On NetEye satellites, nginx proxies GLPI inventory submissions from agents to the GLPI instance running on the master. Until now, the proxy covered only one endpoint, /glpi/front/inventory.php. However, agents that rely on the glpiinventory plugin may also exchange data with the…
Read MoreImportant: Grafana security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the grafana packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Two of the three CVEs are reachable by any low-privileged authenticated user: an oversized request to the Prometheus rule…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: CVEs Most of the 19 CVEs are Missing/Incorrect Authorization flaws in the Admin REST API and Fine-Grained Admin Permissions (FGAP) v2:…
Read MoreTornado: Allow disabling forwarding of local system logs to Tornado By default, rsyslog on NetEye nodes forwards all logs it handles to the Tornado event engine. These include the system logs of the NetEye node itself, which can generate a large number of syslog events on Tornado. Until now, there was no way to turn…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Elastic Agent Elasticsearch Kibana Most of the 8 CVEs are resource-exhaustion weaknesses in Elasticsearch. These are Uncontrolled…
Read MoreWhen the GLPI inventory plugin is used to collect agent inventories, assets may fail to appear in GLPI even though the agents reach the server. The cause was a bug in the Icinga Web 2 SSO plugin: GLPI 11 marks the inventory plugin’s endpoints as “stateless,” and the SSO plugin wrongly treated them like static…
Read MoreUpdate of Elastic Stack to Version 9.4.7 Elastic Stack 9.4.7 delivers targeted fixes across Elasticsearch, Kibana, Fleet Server, Logstash, Elastic Observability, and Elastic Security. Elasticsearch improves memory protection, ES|QL correctness, kNN filtering, vector compatibility, and data-stream auto-sharding. Kibana addresses issues across dashboards, alerting, Fleet, and platform stability, while Fleet Server fixes version-specific agent re-enrollment, upgrade…
Read MoreImportant: Grafana security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the grafana packages is now available for NetEye 4. Security Fix for NetEye 4.49 Summary An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule…
Read More