fix: resolve 5 HIGH-severity CVEs blocking nightly container image scan

Patch vulnerable transitive dependencies across all three compiled binaries in the Docker image (backend, Caddy, CrowdSec): - go-jose/v3 and v4: JOSE/JWT validation bypass (CVE-2026-34986) - otel/sdk: resource leak in OpenTelemetry SDK (CVE-2026-39883) - pgproto3/v2: buffer overflow via pgx/v4 bump (CVE-2026-32286) - AWS SDK v2: event stream injection in CrowdSec deps (GHSA-xmrv-pmrh-hhx2) - OTel HTTP exporters: request smuggling (CVE-2026-39882) - gRPC: bumped to v1.80.0 for transitive go-jose/v4 resolution All Dockerfile patches include Renovate annotations for automated future tracking. Renovate config extended to cover Go version and GitHub Action refs in skill example workflows, preventing version drift in non-CI files. SECURITY.md updated with pre-existing Alpine base image CVE (no upstream fix available). Nightly Go stdlib CVEs (1.26.1) self-heal on next development sync; example workflow pinned to 1.26.2 for correctness.
2026-04-09 17:24:25 +00:00
parent bb496daae3
commit 580e20d573
10 changed files with 1057 additions and 131 deletions
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -232,9 +232,24 @@
      "datasourceTemplate": "github-releases",
      "versioningTemplate": "semver",
      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "description": "Track go-version in skill example workflows",
+      "managerFilePatterns": ["/^\\.github/skills/examples/.*\\.yml$/"],
+      "matchStrings": [
+        "go-version: [\"']?(?<currentValue>[\\d\\.]+)[\"']?"
+      ],
+      "depNameTemplate": "golang/go",
+      "datasourceTemplate": "golang-version",
+      "versioningTemplate": "semver"
    }
  ],

+  "github-actions": {
+    "fileMatch": ["^\\.github/skills/examples/.*\\.ya?ml$"]
+  },
+
  "packageRules": [
    {
      "description": "THE MEGAZORD: Group ALL non-major updates (NPM, Docker, Go, Actions) into one PR",
--- a/.github/skills/examples/gorm-scanner-ci-workflow.yml
+++ b/.github/skills/examples/gorm-scanner-ci-workflow.yml
@@ -25,7 +25,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: "1.26.1"
+          go-version: "1.26.2"

      - name: Run GORM Security Scanner
        id: gorm-scan
--- a/36
+++ b/36
@@ -282,11 +282,27 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
        # renovate: datasource=go depName=github.com/hslatman/ipstore
        go get github.com/hslatman/ipstore@v0.4.0; \
        go get golang.org/x/net@v${XNET_VERSION}; \
-        # CVE-2026-33186 (GHSA-p77j-4mvh-x3m3): gRPC-Go auth bypass via missing leading slash
-        # Fix available at v1.79.3. Pin here so the Caddy binary is patched immediately;
-        # remove once Caddy ships a release built with grpc >= v1.79.3.
+        # CVE-2026-33186: gRPC-Go auth bypass (fixed in v1.79.3)
+        # CVE-2026-34986: go-jose/v4 transitive fix (requires grpc >= v1.80.0)
+        # Pin here so the Caddy binary is patched immediately;
+        # remove once Caddy ships a release built with grpc >= v1.80.0.
        # renovate: datasource=go depName=google.golang.org/grpc
-        go get google.golang.org/grpc@v1.79.3; \
+        go get google.golang.org/grpc@v1.80.0; \
+        # CVE-2026-34986: go-jose JOSE/JWT validation bypass
+        # renovate: datasource=go depName=github.com/go-jose/go-jose/v3
+        go get github.com/go-jose/go-jose/v3@v3.0.5; \
+        # renovate: datasource=go depName=github.com/go-jose/go-jose/v4
+        go get github.com/go-jose/go-jose/v4@v4.1.4; \
+        # CVE-2026-39883: OTel SDK resource leak
+        # renovate: datasource=go depName=go.opentelemetry.io/otel/sdk
+        go get go.opentelemetry.io/otel/sdk@v1.43.0; \
+        # CVE-2026-39882: OTel HTTP exporter request smuggling
+        # renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
+        go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0; \
+        # renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
+        go get go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0; \
+        # renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
+        go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0; \
        # GHSA-479m-364c-43vc: goxmldsig XML signature validation bypass (loop variable capture)
        # Fix available at v1.6.0. Pin here so the Caddy binary is patched immediately;
        # remove once caddy-security ships a release built with goxmldsig >= v1.6.0.
@@ -365,6 +381,18 @@ RUN go get github.com/expr-lang/expr@v${EXPR_LANG_VERSION} && \
    # remove once CrowdSec ships a release built with grpc >= v1.79.3.
    # renovate: datasource=go depName=google.golang.org/grpc
    go get google.golang.org/grpc@v1.80.0 && \
+    # CVE-2026-32286: pgproto3/v2 buffer overflow (no v2 fix exists; bump pgx/v4 to latest patch)
+    # renovate: datasource=go depName=github.com/jackc/pgx/v4
+    go get github.com/jackc/pgx/v4@v4.18.3 && \
+    # GHSA-xmrv-pmrh-hhx2: AWS SDK v2 event stream injection
+    # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
+    go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 && \
+    # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
+    go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.68.0 && \
+    # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/kinesis
+    go get github.com/aws/aws-sdk-go-v2/service/kinesis@v1.43.5 && \
+    # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/s3
+    go get github.com/aws/aws-sdk-go-v2/service/s3@v1.99.0 && \
    go mod tidy

 # Fix compatibility issues with expr-lang v1.17.7
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -27,7 +27,7 @@ public disclosure.

 ## Known Vulnerabilities

-Last reviewed: 2026-04-04
+Last reviewed: 2026-04-09

 ### [HIGH] CVE-2026-2673 · OpenSSL TLS 1.3 Key Exchange Group Downgrade

@@ -197,6 +197,48 @@ available for the current `docker/docker` import path.

 ---

+### [HIGH] CVE-2026-31790 · OpenSSL Vulnerability in Alpine Base Image
+
+| Field        | Value |
+|--------------|-------|
+| **ID**       | CVE-2026-31790 (affects `libcrypto3` and `libssl3`) |
+| **Severity** | High |
+| **Status**   | Awaiting Upstream |
+
+**What**
+An OpenSSL vulnerability in the Alpine base image system packages `libcrypto3` and `libssl3`.
+This is a pre-existing issue in the Alpine base image and was not introduced by Charon.
+
+**Who**
+
+- Discovered by: Automated scan (Grype)
+- Reported: 2026-04-09
+- Affects: Container runtime environment; does not affect Charon application code directly
+
+**Where**
+
+- Component: Alpine base image (`libcrypto3`, `libssl3`)
+- Versions affected: Current Alpine base image OpenSSL packages
+
+**When**
+
+- Discovered: 2026-04-09
+- Disclosed (if public): Public
+- Target fix: When Alpine Security publishes a patched OpenSSL APK
+
+**How**
+The vulnerability resides in Alpine's system OpenSSL library and affects TLS operations at
+the OS level. Charon's application code does not directly invoke these libraries. Practical
+exploitability depends on direct TLS usage through the system OpenSSL, which is limited to
+the container runtime environment.
+
+**Planned Remediation**
+Monitor <https://security.alpinelinux.org/> for a patched Alpine APK. No upstream fix
+available as of 2026-04-09. Once available, update the pinned `ALPINE_IMAGE` digest in the
+Dockerfile.
+
+---
+
 ## Patched Vulnerabilities

 ### ✅ [LOW] CVE-2026-26958 · edwards25519 MultiScalarMult Invalid Results
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -86,13 +86,12 @@ require (
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
 	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	golang.org/x/arch v0.25.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -181,10 +181,10 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8V
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
 go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0/go.mod h1:v0Tj04armyT59mnURNUJf7RCKcKzq+lgJs6QSjHjaTc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
 go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
 go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
 go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
@@ -193,8 +193,8 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
 go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
 go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
-go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -219,12 +219,12 @@ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
 golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/docs/plans/archive/crowdsec-hub-bootstrap-spec.md
+++ b/docs/plans/archive/crowdsec-hub-bootstrap-spec.md
@@ -0,0 +1,159 @@
+# CrowdSec Hub Bootstrapping on Container Startup
+
+## Problem Statement
+
+After a container rebuild, CrowdSec has **zero collections installed** and a **stale hub index**. When users (or the backend) attempt to install collections, they encounter hash mismatch errors because the hub index bundled in the image at build time is outdated by the time the container runs.
+
+The root cause is twofold:
+
+1. `cscli hub update` in the entrypoint only runs if `.index.json` is missing — not if it is stale.
+2. `install_hub_items.sh` (which does call `cscli hub update`) is gated behind `SECURITY_CROWDSEC_MODE=local`, an env var that is **deprecated** and no longer set by default. The entrypoint checks `$SECURITY_CROWDSEC_MODE`, but the backend reads `CERBERUS_SECURITY_CROWDSEC_MODE` / `CHARON_SECURITY_CROWDSEC_MODE` — a naming mismatch that means the entrypoint gate never opens.
+
+## Current State Analysis
+
+### Dockerfile (build-time)
+
+| Aspect | What Happens |
+|---|---|
+| CrowdSec binaries | Built from source in `crowdsec-builder` stage, copied to `/usr/local/bin/{crowdsec,cscli}` |
+| Config template | Source config copied to `/etc/crowdsec.dist/` |
+| Hub index | **Not pre-populated** — no `cscli hub update` at build time |
+| Collections | **Not installed** at build time |
+| Symlink | `/etc/crowdsec` → `/app/data/crowdsec/config` created as root before `USER charon` |
+| Helper scripts | `install_hub_items.sh` and `register_bouncer.sh` copied to `/usr/local/bin/` |
+
+### Entrypoint (`.docker/docker-entrypoint.sh`, runtime)
+
+| Step | What Happens | Problem |
+|---|---|---|
+| Config init | Copies `/etc/crowdsec.dist/*` → `/app/data/crowdsec/config/` on first run | Works correctly |
+| Symlink verify | Confirms `/etc/crowdsec` → `/app/data/crowdsec/config` | Works correctly |
+| LAPI port fix | `sed` replaces `:8080` → `:8085` in config files | Works correctly |
+| Hub update (L313-315) | `cscli hub update` runs **only if** `/etc/crowdsec/hub/.index.json` does not exist | **Bug**: stale index is never refreshed |
+| Machine registration | `cscli machines add -a --force` | Works correctly |
+| Hub items install (L325-328) | Calls `install_hub_items.sh` **only if** `$SECURITY_CROWDSEC_MODE = "local"` | **Bug**: env var is deprecated, never set; wrong var name vs backend |
+| Ownership fix | `chown -R charon:charon` on CrowdSec dirs | Works correctly |
+
+### `install_hub_items.sh` (when invoked)
+
+The script itself is well-structured — it calls `cscli hub update` then installs individual parsers, scenarios, and two collections (`crowdsecurity/http-cve`, `crowdsecurity/base-http-scenarios`). It does **not** install `crowdsecurity/caddy`.
+
+### Backend (`crowdsec_startup.go`)
+
+`ReconcileCrowdSecOnStartup()` checks the database for CrowdSec mode and starts the process if needed. It does **not** call `cscli hub update` or install collections. The `HubService.runCSCLI()` method in `hub_sync.go` does call `cscli hub update` before individual item installs, but this is only triggered by explicit GUI actions (Pull/Apply), not at startup.
+
+## Proposed Changes
+
+### File: `.docker/docker-entrypoint.sh`
+
+**Change 1: Always refresh the hub index**
+
+Replace the conditional hub update (current L313-315):
+
+```sh
+# CURRENT (broken):
+if [ ! -f "/etc/crowdsec/hub/.index.json" ]; then
+    echo "Updating CrowdSec hub index..."
+    timeout 60s cscli hub update 2>/dev/null || echo "⚠️ Hub update timed out or failed, continuing..."
+fi
+```
+
+With an unconditional update:
+
+```sh
+# NEW: Always refresh hub index on startup (stale index causes hash mismatch errors)
+echo "Updating CrowdSec hub index..."
+if ! timeout 60s cscli hub update 2>&1; then
+    echo "⚠️ Hub index update failed (network issue?). Collections may fail to install."
+    echo "   CrowdSec will still start with whatever index is cached."
+fi
+```
+
+**Change 2: Always install required collections (remove env var gate)**
+
+Replace the conditional hub items install (current L322-328):
+
+```sh
+# CURRENT (broken — env var never set):
+if [ "$SECURITY_CROWDSEC_MODE" = "local" ]; then
+    echo "Installing CrowdSec hub items..."
+    if [ -x /usr/local/bin/install_hub_items.sh ]; then
+        /usr/local/bin/install_hub_items.sh 2>/dev/null || echo "Warning: Some hub items may not have installed"
+    fi
+fi
+```
+
+With unconditional execution:
+
+```sh
+# NEW: Always ensure required collections are present.
+# This is idempotent — already-installed items are skipped by cscli.
+# Collections are needed regardless of whether CrowdSec is GUI-enabled,
+# because the user can enable CrowdSec at any time via the dashboard
+# and expects it to work immediately.
+echo "Ensuring CrowdSec hub items are installed..."
+if [ -x /usr/local/bin/install_hub_items.sh ]; then
+    /usr/local/bin/install_hub_items.sh || echo "⚠️ Some hub items may not have installed. CrowdSec can still start."
+fi
+```
+
+### File: `configs/crowdsec/install_hub_items.sh`
+
+**Change 3: Add `crowdsecurity/caddy` collection**
+
+Add after the existing `crowdsecurity/base-http-scenarios` install:
+
+```sh
+# Install Caddy collection (parser + scenarios for Caddy access logs)
+echo "Installing Caddy collection..."
+cscli collections install crowdsecurity/caddy --force 2>/dev/null || true
+```
+
+**Change 4: Remove redundant individual parser installs that are included in collections**
+
+The `crowdsecurity/base-http-scenarios` collection already includes `crowdsecurity/http-logs` and several of the individually installed scenarios. The `crowdsecurity/caddy` collection includes `crowdsecurity/caddy-logs`. Keep the individual installs as fallbacks (they are idempotent), but add a comment noting the overlap. No lines need deletion — the `--force` flag and idempotency make this safe.
+
+### Summary of File Changes
+
+| File | Change | Lines |
+|---|---|---|
+| `.docker/docker-entrypoint.sh` | Unconditional `cscli hub update` | ~L313-315 |
+| `.docker/docker-entrypoint.sh` | Remove `SECURITY_CROWDSEC_MODE` gate on hub items install | ~L322-328 |
+| `configs/crowdsec/install_hub_items.sh` | Add `crowdsecurity/caddy` collection install | After L60 |
+
+## Edge Cases
+
+| Scenario | Handling |
+|---|---|
+| **No network at startup** | `cscli hub update` fails with timeout. The `install_hub_items.sh` also fails. Entrypoint continues — CrowdSec starts with whatever is cached (or no collections). User can retry via GUI. |
+| **Hub CDN returns 5xx** | Same as no network — timeout + fallback. |
+| **Collections already installed** | `--force` flag makes `cscli collections install` idempotent. It updates to latest if newer version available. |
+| **First boot (no prior data volume)** | Config gets copied from `.dist`, hub update runs, collections install. Clean bootstrap path. |
+| **Existing data volume (upgrade)** | Config already exists (skips copy), hub update refreshes stale index, collections install/upgrade. |
+| **`install_hub_items.sh` missing/not executable** | `-x` check in entrypoint skips it with a log message. CrowdSec starts without collections. |
+| **CrowdSec disabled in GUI** | Collections are still installed (they are just config files). No process runs until user enables via GUI. Zero runtime cost. |
+
+## Startup Time Impact
+
+- `cscli hub update`: ~2-5s (single HTTPS request to hub CDN)
+- `install_hub_items.sh`: ~10-15s (multiple `cscli` invocations, each checking/installing)
+- Total additional startup time: **~12-20s** (first boot) / **~5-10s** (subsequent boots, items cached)
+
+This is acceptable for a container that runs long-lived.
+
+## Acceptance Criteria
+
+1. After `docker compose up` with a fresh data volume, `cscli collections list` shows `crowdsecurity/caddy`, `crowdsecurity/base-http-scenarios`, and `crowdsecurity/http-cve` installed.
+2. After `docker compose up` with an existing data volume (stale index), hub index is refreshed and collections remain installed.
+3. If the container starts with no network, CrowdSec initialization logs warnings but does not crash or block startup.
+4. No env var (`SECURITY_CROWDSEC_MODE`) is required for collections to be installed.
+5. Startup time increase is < 30 seconds.
+
+## Commit Slicing Strategy
+
+**Decision**: Single PR. Scope is small (3 files, ~15 lines changed), low risk, and all changes are tightly coupled.
+
+**PR-1**: CrowdSec hub bootstrapping fix
+- **Scope**: `.docker/docker-entrypoint.sh`, `configs/crowdsec/install_hub_items.sh`
+- **Validation**: Manual docker rebuild + verify collections with `cscli collections list`
+- **Rollback**: Revert PR; behavior returns to current (broken) state — no data loss risk
--- a/docs/plans/current_spec.md
+++ b/docs/plans/current_spec.md
@@ -1,159 +1,395 @@
-# CrowdSec Hub Bootstrapping on Container Startup
+# Nightly Build Vulnerability Remediation Plan

-## Problem Statement
+**Date**: 2026-04-09
+**Status**: Draft — Awaiting Approval
+**Scope**: Dependency security patches for 5 HIGH + 3 MEDIUM vulnerability groups
+**Target**: Single PR — all changes ship together
+**Archived**: Previous plan (CrowdSec Hub Bootstrapping) → `docs/plans/archive/crowdsec-hub-bootstrap-spec.md`

-After a container rebuild, CrowdSec has **zero collections installed** and a **stale hub index**. When users (or the backend) attempt to install collections, they encounter hash mismatch errors because the hub index bundled in the image at build time is outdated by the time the container runs.
+---

-The root cause is twofold:
+## 1. Problem Statement

-1. `cscli hub update` in the entrypoint only runs if `.index.json` is missing — not if it is stale.
-2. `install_hub_items.sh` (which does call `cscli hub update`) is gated behind `SECURITY_CROWDSEC_MODE=local`, an env var that is **deprecated** and no longer set by default. The entrypoint checks `$SECURITY_CROWDSEC_MODE`, but the backend reads `CERBERUS_SECURITY_CROWDSEC_MODE` / `CHARON_SECURITY_CROWDSEC_MODE` — a naming mismatch that means the entrypoint gate never opens.
+The Charon nightly build is failing container image vulnerability scans with **5 HIGH-severity** and **multiple MEDIUM-severity** findings. These vulnerabilities exist across three compiled binaries embedded in the container image:

-## Current State Analysis
+1. **Charon backend** (`/app/charon`) — Go binary built from `backend/go.mod`
+2. **Caddy** (`/usr/bin/caddy`) — Built via xcaddy in the Dockerfile Caddy builder stage
+3. **CrowdSec** (`/usr/local/bin/crowdsec`, `/usr/local/bin/cscli`) — Built from source in the Dockerfile CrowdSec builder stage

-### Dockerfile (build-time)
+Additionally, the **nightly branch** was synced from development before the Go 1.26.2 bump landed, so the nightly image was compiled with Go 1.26.1 (confirmed in `ci_failure.log` line 55: `GO_VERSION: 1.26.1`).

-| Aspect | What Happens |
-|---|---|
-| CrowdSec binaries | Built from source in `crowdsec-builder` stage, copied to `/usr/local/bin/{crowdsec,cscli}` |
-| Config template | Source config copied to `/etc/crowdsec.dist/` |
-| Hub index | **Not pre-populated** — no `cscli hub update` at build time |
-| Collections | **Not installed** at build time |
-| Symlink | `/etc/crowdsec` → `/app/data/crowdsec/config` created as root before `USER charon` |
-| Helper scripts | `install_hub_items.sh` and `register_bouncer.sh` copied to `/usr/local/bin/` |
+---

-### Entrypoint (`.docker/docker-entrypoint.sh`, runtime)
+## 2. Research Findings

-| Step | What Happens | Problem |
-|---|---|---|
-| Config init | Copies `/etc/crowdsec.dist/*` → `/app/data/crowdsec/config/` on first run | Works correctly |
-| Symlink verify | Confirms `/etc/crowdsec` → `/app/data/crowdsec/config` | Works correctly |
-| LAPI port fix | `sed` replaces `:8080` → `:8085` in config files | Works correctly |
-| Hub update (L313-315) | `cscli hub update` runs **only if** `/etc/crowdsec/hub/.index.json` does not exist | **Bug**: stale index is never refreshed |
-| Machine registration | `cscli machines add -a --force` | Works correctly |
-| Hub items install (L325-328) | Calls `install_hub_items.sh` **only if** `$SECURITY_CROWDSEC_MODE = "local"` | **Bug**: env var is deprecated, never set; wrong var name vs backend |
-| Ownership fix | `chown -R charon:charon` on CrowdSec dirs | Works correctly |
+### 2.1 Go Version Audit

-### `install_hub_items.sh` (when invoked)
+All files on `development` / `main` already reference **Go 1.26.2**:

-The script itself is well-structured — it calls `cscli hub update` then installs individual parsers, scenarios, and two collections (`crowdsecurity/http-cve`, `crowdsecurity/base-http-scenarios`). It does **not** install `crowdsecurity/caddy`.
+| File | Current Value | Status |
+|------|---------------|--------|
+| `backend/go.mod` | `go 1.26.2` | ✅ Current |
+| `go.work` | `go 1.26.2` | ✅ Current |
+| `Dockerfile` (`ARG GO_VERSION`) | `1.26.2` | ✅ Current |
+| `.github/workflows/nightly-build.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/codecov-upload.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/quality-checks.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/codeql.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/benchmark.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/release-goreleaser.yml` | `'1.26.2'` | ✅ Current |
+| `.github/workflows/e2e-tests-split.yml` | `'1.26.2'` | ✅ Current |
+| `.github/skills/examples/gorm-scanner-ci-workflow.yml` | `'1.26.1'` | ❌ **Stale** |
+| `scripts/install-go-1.26.0.sh` | `1.26.0` | ⚠️ Old install script (not used in CI/Docker builds) |

-### Backend (`crowdsec_startup.go`)
+**Root Cause of Go stdlib CVEs**: The nightly branch's last sync predated the 1.26.2 bump. The next nightly sync from development will propagate 1.26.2 automatically. The only file requiring a fix is the example workflow.

-`ReconcileCrowdSecOnStartup()` checks the database for CrowdSec mode and starts the process if needed. It does **not** call `cscli hub update` or install collections. The `HubService.runCSCLI()` method in `hub_sync.go` does call `cscli hub update` before individual item installs, but this is only triggered by explicit GUI actions (Pull/Apply), not at startup.
+### 2.2 Vulnerability Inventory

-## Proposed Changes
+#### HIGH Severity (must fix — merge-blocking)

-### File: `.docker/docker-entrypoint.sh`
+| # | CVE / GHSA | Package | Current | Fix | Binary | Dep Type |
+|---|-----------|---------|---------|-----|--------|----------|
+| 1 | CVE-2026-39883 | `go.opentelemetry.io/otel/sdk` | v1.40.0 | v1.43.0 | Caddy | Transitive (Caddy plugins → otelhttp → otel/sdk) |
+| 2 | CVE-2026-34986 | `github.com/go-jose/go-jose/v3` | v3.0.4 | **v3.0.5** | Caddy | Transitive (caddy-security → JWT/JOSE stack) |
+| 3 | CVE-2026-34986 | `github.com/go-jose/go-jose/v4` | v4.1.3 | **v4.1.4** | Caddy | Transitive (grpc v1.79.3 → go-jose/v4) |
+| 4 | CVE-2026-32286 | `github.com/jackc/pgproto3/v2` | v2.3.3 | pgx/v4 v4.18.3 ¹ | CrowdSec | Transitive (CrowdSec → pgx/v4 v4.18.2 → pgproto3/v2) |

-**Change 1: Always refresh the hub index**
+¹ pgproto3/v2 has **no patched release**. Fix requires upstream migration to pgx/v5 (uses pgproto3/v3). See §5 Risk Assessment.

-Replace the conditional hub update (current L313-315):
+#### MEDIUM Severity (fix in same pass)

-```sh
-# CURRENT (broken):
-if [ ! -f "/etc/crowdsec/hub/.index.json" ]; then
-    echo "Updating CrowdSec hub index..."
-    timeout 60s cscli hub update 2>/dev/null || echo "⚠️ Hub update timed out or failed, continuing..."
-fi
+| # | CVE / GHSA | Package(s) | Current | Fix | Binary | Dep Type |
+|---|-----------|------------|---------|-----|--------|----------|
+| 5 | GHSA-xmrv-pmrh-hhx2 | AWS SDK v2: `eventstream` v1.7.1, `cloudwatchlogs` v1.57.2, `kinesis` v1.40.1, `s3` v1.87.3 | See left | Bump all | CrowdSec | Direct deps of CrowdSec v1.7.7 |
+| 6 | CVE-2026-32281, -32288, -32289 | Go stdlib | 1.26.1 | **1.26.2** | All (nightly image) | Toolchain |
+| 7 | CVE-2026-39882 | OTel HTTP exporters: `otlploghttp` v0.16.0, `otlpmetrichttp` v1.40.0, `otlptracehttp` v1.40.0 | See left | Bump all | Caddy | Transitive (Caddy plugins → OTel exporters) |
+
+### 2.3 Dependency Chain Analysis
+
+#### Backend (`backend/go.mod`)
+
+```
+charon/backend (direct)
+  └─ docker/docker v28.5.2+incompatible (direct)
+       └─ otelhttp v0.68.0 (indirect)
+            └─ otel/sdk v1.43.0 (indirect) — already at latest
+  └─ grpc v1.79.3 (indirect)
+  └─ otlptracehttp v1.42.0 (indirect) ── CVE-2026-39882
 ```

-With an unconditional update:
+Backend resolved versions (verified via `go list -m -json`):

-```sh
-# NEW: Always refresh hub index on startup (stale index causes hash mismatch errors)
-echo "Updating CrowdSec hub index..."
-if ! timeout 60s cscli hub update 2>&1; then
-    echo "⚠️ Hub index update failed (network issue?). Collections may fail to install."
-    echo "   CrowdSec will still start with whatever index is cached."
-fi
+| Package | Version | Type |
+|---------|---------|------|
+| `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` | v1.42.0 | indirect |
+| `google.golang.org/grpc` | v1.79.3 | indirect |
+| `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` | v0.68.0 | indirect |
+
+**Not present in backend**: go-jose/v3, go-jose/v4, otel/sdk, pgproto3/v2, AWS SDK, otlploghttp, otlpmetrichttp.
+
+#### CrowdSec Binary (Dockerfile `crowdsec-builder` stage)
+
+Source: CrowdSec v1.7.7 `go.mod` (verified via `git clone --depth 1 --branch v1.7.7`):
+
+```
+crowdsec v1.7.7
+  └─ pgx/v4 v4.18.2 (direct) → pgproto3/v2 v2.3.3 (indirect) ── CVE-2026-32286
+  └─ aws-sdk-go-v2/service/s3 v1.87.3 (direct) ── GHSA-xmrv-pmrh-hhx2
+  └─ aws-sdk-go-v2/service/cloudwatchlogs v1.57.2 (direct) ── GHSA-xmrv-pmrh-hhx2
+  └─ aws-sdk-go-v2/service/kinesis v1.40.1 (direct) ── GHSA-xmrv-pmrh-hhx2
+  └─ aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 (indirect) ── GHSA-xmrv-pmrh-hhx2
+  └─ otel v1.39.0, otel/metric v1.39.0, otel/trace v1.39.0 (indirect)
 ```

-**Change 2: Always install required collections (remove env var gate)**
+Confirmed by Trivy image scan (`trivy-image-report.json`): pgproto3/v2 v2.3.3 flagged in `usr/local/bin/crowdsec` and `usr/local/bin/cscli`.

-Replace the conditional hub items install (current L322-328):
+#### Caddy Binary (Dockerfile `caddy-builder` stage)

-```sh
-# CURRENT (broken — env var never set):
-if [ "$SECURITY_CROWDSEC_MODE" = "local" ]; then
-    echo "Installing CrowdSec hub items..."
-    if [ -x /usr/local/bin/install_hub_items.sh ]; then
-        /usr/local/bin/install_hub_items.sh 2>/dev/null || echo "Warning: Some hub items may not have installed"
-    fi
-fi
+Built via xcaddy with plugins. go.mod is generated at build time. Vulnerable packages enter via:
+
+```
+xcaddy build (Caddy v2.11.2 + plugins)
+  └─ caddy-security v1.1.61 → go-jose/v3 (JWT auth stack) ── CVE-2026-34986
+  └─ grpc (patched to v1.79.3 in Dockerfile) → go-jose/v4 v4.1.3 ── CVE-2026-34986
+  └─ Caddy/plugins → otel/sdk v1.40.0 ── CVE-2026-39883
+  └─ Caddy/plugins → otlploghttp v0.16.0, otlpmetrichttp v1.40.0, otlptracehttp v1.40.0 ── CVE-2026-39882
 ```

-With unconditional execution:
+---

-```sh
-# NEW: Always ensure required collections are present.
-# This is idempotent — already-installed items are skipped by cscli.
-# Collections are needed regardless of whether CrowdSec is GUI-enabled,
-# because the user can enable CrowdSec at any time via the dashboard
-# and expects it to work immediately.
-echo "Ensuring CrowdSec hub items are installed..."
-if [ -x /usr/local/bin/install_hub_items.sh ]; then
-    /usr/local/bin/install_hub_items.sh || echo "⚠️ Some hub items may not have installed. CrowdSec can still start."
-fi
+## 3. Technical Specifications
+
+### 3.1 Backend go.mod Changes
+
+**File**: `backend/go.mod` (+ `backend/go.sum` auto-generated)
+
+```bash
+cd backend
+
+# Upgrade grpc to v1.80.0 (security patches for transitive deps)
+go get google.golang.org/grpc@v1.80.0
+
+# CVE-2026-39882: OTel HTTP exporter (backend only has otlptracehttp)
+go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0
+
+go mod tidy
 ```

-### File: `configs/crowdsec/install_hub_items.sh`
+Expected `go.mod` diff:
+- `google.golang.org/grpc` v1.79.3 → v1.80.0
+- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` v1.42.0 → v1.43.0

-**Change 3: Add `crowdsecurity/caddy` collection**
+### 3.2 Dockerfile — Caddy Builder Stage Patches

-Add after the existing `crowdsecurity/base-http-scenarios` install:
+**File**: `Dockerfile`, within the caddy-builder `RUN bash -c '...'` block, in the **Stage 2: Apply security patches** section.

-```sh
-# Install Caddy collection (parser + scenarios for Caddy access logs)
-echo "Installing Caddy collection..."
-cscli collections install crowdsecurity/caddy --force 2>/dev/null || true
+Add after the existing `go get golang.org/x/net@v${XNET_VERSION};` line:
+
+```bash
+# CVE-2026-34986: go-jose JOSE/JWT validation bypass
+# Fix in v3.0.5 and v4.1.4. Pin here until caddy-security ships fix.
+# renovate: datasource=go depName=github.com/go-jose/go-jose/v3
+go get github.com/go-jose/go-jose/v3@v3.0.5; \
+# renovate: datasource=go depName=github.com/go-jose/go-jose/v4
+go get github.com/go-jose/go-jose/v4@v4.1.4; \
+# CVE-2026-39883: OTel SDK resource leak
+# Fix in v1.43.0. Pin here until Caddy ships with updated OTel.
+# renovate: datasource=go depName=go.opentelemetry.io/otel/sdk
+go get go.opentelemetry.io/otel/sdk@v1.43.0; \
+# CVE-2026-39882: OTel HTTP exporter request smuggling
+# renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
+go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0; \
+# renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
+go get go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0; \
+# renovate: datasource=go depName=go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
+go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0; \
 ```

-**Change 4: Remove redundant individual parser installs that are included in collections**
+Update existing grpc patch line from `v1.79.3` → `v1.80.0`:

-The `crowdsecurity/base-http-scenarios` collection already includes `crowdsecurity/http-logs` and several of the individually installed scenarios. The `crowdsecurity/caddy` collection includes `crowdsecurity/caddy-logs`. Keep the individual installs as fallbacks (they are idempotent), but add a comment noting the overlap. No lines need deletion — the `--force` flag and idempotency make this safe.
+```bash
+# Before:
+go get google.golang.org/grpc@v1.79.3; \
+# After:
+# CVE-2026-33186: gRPC-Go auth bypass (fixed in v1.79.3)
+# CVE-2026-34986: go-jose/v4 transitive fix (requires grpc >= v1.80.0)
+# renovate: datasource=go depName=google.golang.org/grpc
+go get google.golang.org/grpc@v1.80.0; \
+```

-### Summary of File Changes
+### 3.3 Dockerfile — CrowdSec Builder Stage Patches

-| File | Change | Lines |
-|---|---|---|
-| `.docker/docker-entrypoint.sh` | Unconditional `cscli hub update` | ~L313-315 |
-| `.docker/docker-entrypoint.sh` | Remove `SECURITY_CROWDSEC_MODE` gate on hub items install | ~L322-328 |
-| `configs/crowdsec/install_hub_items.sh` | Add `crowdsecurity/caddy` collection install | After L60 |
+**File**: `Dockerfile`, within the crowdsec-builder `RUN` block that patches dependencies.

-## Edge Cases
+Add after the existing `go get golang.org/x/net@v${XNET_VERSION}` line:

-| Scenario | Handling |
-|---|---|
-| **No network at startup** | `cscli hub update` fails with timeout. The `install_hub_items.sh` also fails. Entrypoint continues — CrowdSec starts with whatever is cached (or no collections). User can retry via GUI. |
-| **Hub CDN returns 5xx** | Same as no network — timeout + fallback. |
-| **Collections already installed** | `--force` flag makes `cscli collections install` idempotent. It updates to latest if newer version available. |
-| **First boot (no prior data volume)** | Config gets copied from `.dist`, hub update runs, collections install. Clean bootstrap path. |
-| **Existing data volume (upgrade)** | Config already exists (skips copy), hub update refreshes stale index, collections install/upgrade. |
-| **`install_hub_items.sh` missing/not executable** | `-x` check in entrypoint skips it with a log message. CrowdSec starts without collections. |
-| **CrowdSec disabled in GUI** | Collections are still installed (they are just config files). No process runs until user enables via GUI. Zero runtime cost. |
+```bash
+# CVE-2026-32286: pgproto3/v2 buffer overflow (no v2 fix exists; bump pgx/v4 to latest patch)
+# renovate: datasource=go depName=github.com/jackc/pgx/v4
+go get github.com/jackc/pgx/v4@v4.18.3 && \
+# GHSA-xmrv-pmrh-hhx2: AWS SDK v2 event stream injection
+# renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
+go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 && \
+# renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
+go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.68.0 && \
+# renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/kinesis
+go get github.com/aws/aws-sdk-go-v2/service/kinesis@v1.43.5 && \
+# renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/s3
+go get github.com/aws/aws-sdk-go-v2/service/s3@v1.99.0 && \
+```

-## Startup Time Impact
+CrowdSec grpc already at v1.80.0 — no change needed.

- `cscli hub update`: ~2-5s (single HTTPS request to hub CDN)
- `install_hub_items.sh`: ~10-15s (multiple `cscli` invocations, each checking/installing)
- Total additional startup time: **~12-20s** (first boot) / **~5-10s** (subsequent boots, items cached)
+### 3.4 Example Workflow Fix

-This is acceptable for a container that runs long-lived.
+**File**: `.github/skills/examples/gorm-scanner-ci-workflow.yml` (line 28)

-## Acceptance Criteria
+```yaml
+# Before:
+          go-version: "1.26.1"
+# After:
+          go-version: "1.26.2"
+```

-1. After `docker compose up` with a fresh data volume, `cscli collections list` shows `crowdsecurity/caddy`, `crowdsecurity/base-http-scenarios`, and `crowdsecurity/http-cve` installed.
-2. After `docker compose up` with an existing data volume (stale index), hub index is refreshed and collections remain installed.
-3. If the container starts with no network, CrowdSec initialization logs warnings but does not crash or block startup.
-4. No env var (`SECURITY_CROWDSEC_MODE`) is required for collections to be installed.
-5. Startup time increase is < 30 seconds.
+### 3.5 Go Stdlib CVEs (nightly branch — no code change needed)

-## Commit Slicing Strategy
+The nightly workflow syncs `development → nightly` via `git merge --ff-only`. Since `development` already has Go 1.26.2 everywhere:
+- Dockerfile `ARG GO_VERSION=1.26.2` ✓
+- All CI workflows `GO_VERSION: '1.26.2'` ✓
+- `backend/go.mod` `go 1.26.2` ✓

-**Decision**: Single PR. Scope is small (3 files, ~15 lines changed), low risk, and all changes are tightly coupled.
+The next nightly run at 09:00 UTC will automatically propagate Go 1.26.2 to the nightly branch and rebuild the image.

-**PR-1**: CrowdSec hub bootstrapping fix
- **Scope**: `.docker/docker-entrypoint.sh`, `configs/crowdsec/install_hub_items.sh`
- **Validation**: Manual docker rebuild + verify collections with `cscli collections list`
- **Rollback**: Revert PR; behavior returns to current (broken) state — no data loss risk
+---
+
+## 4. Implementation Plan
+
+### Phase 1: Playwright Tests (N/A)
+
+No UI/UX changes — this is a dependency-only update. Existing E2E tests validate runtime behavior.
+
+### Phase 2: Backend Implementation
+
+| Task | File(s) | Action |
+|------|---------|--------|
+| 2.1 | `backend/go.mod`, `backend/go.sum` | Run `go get` commands from §3.1 |
+| 2.2 | Verify build | `cd backend && go build ./cmd/api` |
+| 2.3 | Verify vet | `cd backend && go vet ./...` |
+| 2.4 | Verify tests | `cd backend && go test ./...` |
+| 2.5 | Verify vulns | `cd backend && govulncheck ./...` |
+
+### Phase 3: Dockerfile Implementation
+
+| Task | File(s) | Action |
+|------|---------|--------|
+| 3.1 | `Dockerfile` (caddy-builder, ~L258-280) | Add go-jose v3/v4, OTel SDK, OTel exporter patches per §3.2 |
+| 3.2 | `Dockerfile` (caddy-builder, ~L270) | Update grpc patch v1.79.3 → v1.80.0 |
+| 3.3 | `Dockerfile` (crowdsec-builder, ~L360-370) | Add pgx, AWS SDK patches per §3.3 |
+| 3.3a | CrowdSec binaries | After patching deps, run `go build` on CrowdSec binaries before full Docker build for faster compilation feedback |
+| 3.4 | `Dockerfile` | Verify `docker build .` completes successfully (amd64) |
+
+### Phase 4: CI / Misc Fixes
+
+| Task | File(s) | Action |
+|------|---------|--------|
+| 4.1 | `.github/skills/examples/gorm-scanner-ci-workflow.yml` | Bump Go version 1.26.1 → 1.26.2 |
+
+### Phase 5: Validation
+
+| Task | Validation |
+|------|------------|
+| 5.1 | `cd backend && go build ./cmd/api` — compiles cleanly |
+| 5.2 | `cd backend && go test ./...` — all tests pass |
+| 5.3 | `cd backend && go vet ./...` — no issues |
+| 5.4 | `cd backend && govulncheck ./...` — 0 findings |
+| 5.5 | `docker build -t charon:vuln-fix .` — image builds for amd64 |
+| 5.6 | Trivy scan on built image: `docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image --severity CRITICAL,HIGH charon:vuln-fix` — 0 HIGH (pgproto3/v2 excepted) |
+| 5.7 | Container health: `docker run -d -p 8080:8080 charon:vuln-fix && curl -f http://localhost:8080/health` |
+| 5.8 | E2E Playwright tests pass against rebuilt container |
+
+---
+
+## 5. Risk Assessment
+
+### Low Risk
+
+| Change | Risk | Rationale |
+|--------|------|-----------|
+| `go-jose/v3` v3.0.4 → v3.0.5 | Low | Security patch release only |
+| `go-jose/v4` v4.1.3 → v4.1.4 | Low | Security patch release only |
+| `otel/sdk` v1.40.0 → v1.43.0 (Caddy) | Low | Minor bumps, backwards compatible |
+| `otlptracehttp` v1.42.0 → v1.43.0 (backend) | Low | Minor bump |
+| OTel exporters (Caddy) | Low | Minor/patch bumps |
+| Go version example fix | None | Non-runtime file |
+
+### Medium Risk
+
+| Change | Risk | Mitigation |
+|--------|------|------------|
+| `grpc` v1.79.3 → v1.80.0 | Medium | Minor version bump. gRPC is indirect — Charon doesn't use gRPC directly. Run full test suite. Verify Caddy and CrowdSec still compile. |
+| AWS SDK major bumps (s3 v1.87→v1.99, cloudwatchlogs v1.57→v1.68, kinesis v1.40→v1.43) | Medium | CrowdSec build may fail if internal APIs changed between versions. Mitigate: run `go mod tidy` after patches and verify CrowdSec binaries compile. **Note:** AWS SDK Go v2 packages use independent semver within the `v1.x.x` line — these are minor version bumps, not major API breaks. |
+| `pgx/v4` v4.18.2 → v4.18.3 | Medium | Patch release should be safe. May not fully resolve pgproto3/v2 since no patched v2 exists. |
+
+### Known Limitation: pgproto3/v2 (CVE-2026-32286)
+
+The `pgproto3/v2` module has **no patched release** — the fix exists only in `pgproto3/v3` (used by `pgx/v5`). CrowdSec v1.7.7 uses `pgx/v4` which depends on `pgproto3/v2`. Remediation:
+
+1. Bump `pgx/v4` to v4.18.3 (latest v4 patch) — may transitively resolve the issue
+2. If scanner still flags pgproto3/v2 after the bump: document as **accepted risk with upstream tracking**
+3. Monitor CrowdSec releases for `pgx/v5` migration
+4. Consider upgrading `CROWDSEC_VERSION` ARG if a newer CrowdSec release ships with pgx/v5
+
+---
+
+## 6. Acceptance Criteria
+
+- [ ] `cd backend && go build ./cmd/api` succeeds with zero warnings
+- [ ] `cd backend && go test ./...` passes with zero failures
+- [ ] `cd backend && go vet ./...` reports zero issues
+- [ ] `cd backend && govulncheck ./...` reports zero findings
+- [ ] Docker image builds successfully for amd64
+- [ ] Trivy/Grype scan of built image shows 0 new HIGH findings (pgproto3/v2 excepted if upstream unpatched)
+- [ ] Container starts, health check passes on port 8080
+- [ ] Existing E2E Playwright tests pass against rebuilt container
+- [ ] No new compile errors in Caddy or CrowdSec builder stages
+- [ ] `backend/go.mod` shows updated versions for grpc, otlptracehttp
+
+---
+
+## 7. Commit Slicing Strategy
+
+### Decision: Single PR
+
+**Rationale**: All changes are dependency version bumps with no feature or behavioral changes. They address a single concern (security vulnerability remediation) and should be reviewed and merged atomically to avoid partial-fix states.
+
+**Trigger reasons for single PR**:
+- All changes are security patches — cannot ship partial fixes
+- Changes span backend + Dockerfile + CI config — logically coupled
+- No risk of one slice breaking another
+- Total diff is small (go.mod/go.sum + Dockerfile patch lines + 1 YAML fix)
+
+### PR-1: Nightly Build Vulnerability Remediation
+
+**Scope**: All changes in §3.1–§3.4
+
+**Files modified**:
+
+| File | Change Type |
+|------|-------------|
+| `backend/go.mod` | Dependency version bumps (grpc, otlptracehttp) |
+| `backend/go.sum` | Auto-generated checksum updates |
+| `Dockerfile` | Add `go get` patches in caddy-builder and crowdsec-builder stages |
+| `.github/skills/examples/gorm-scanner-ci-workflow.yml` | Go version 1.26.1 → 1.26.2 |
+
+**Dependencies**: None (standalone)
+
+**Validation gates**:
+1. `go build` / `go test` / `go vet` / `govulncheck` pass
+2. Docker image builds for amd64
+3. Trivy/Grype scan passes (0 new HIGH)
+4. E2E tests pass
+
+**Rollback**: Revert PR. All changes are version pins — reverting restores previous state with no data migration needed.
+
+### Post-merge Actions
+
+1. Nightly build will automatically sync development → nightly and rebuild the image with all patches
+2. Monitor next nightly scan for zero HIGH findings
+3. If pgproto3/v2 still flagged: open tracking issue for CrowdSec pgx/v5 upstream migration
+4. If any AWS SDK bump breaks CrowdSec compilation: pin to intermediate version and document
+
+---
+
+## 8. Commands Reference
+
+```bash
+# === Backend dependency upgrades ===
+cd /projects/Charon/backend
+
+go get google.golang.org/grpc@v1.80.0
+go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0
+go mod tidy
+
+# === Validate backend ===
+go build ./cmd/api
+go test ./...
+go vet ./...
+govulncheck ./...
+
+# === Docker build (after Dockerfile edits) ===
+cd /projects/Charon
+docker build -t charon:vuln-fix .
+
+# === Scan built image ===
+docker run --rm \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  aquasec/trivy:latest image \
+  --severity CRITICAL,HIGH \
+  charon:vuln-fix
+
+# === Quick container health check ===
+docker run -d --name charon-vuln-test -p 8080:8080 charon:vuln-fix
+sleep 10
+curl -f http://localhost:8080/health
+docker stop charon-vuln-test && docker rm charon-vuln-test
+```
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -1,3 +1,128 @@
+# QA Audit Report — Nightly Build Vulnerability Remediation
+
+**Date**: 2026-04-09
+**Scope**: Dependency-only update — no feature or UI changes
+**Image Under Test**: `charon:vuln-fix` (built 2026-04-09 14:53 UTC, 632MB)
+**Branch**: Current working tree (pre-PR)
+
+---
+
+## Gate Results Summary
+
+| # | Gate | Status | Details |
+|---|------|--------|---------|
+| 1 | E2E Playwright (Firefox 4/4 shards + Chromium spot check) | PASS | 19 passed, 20 skipped (security suite), 0 failed |
+| 2 | Backend Tests + Coverage | PASS | All tests pass, 88.2% statements / 88.4% lines (gate: 87%) |
+| 3 | Frontend Tests + Coverage | PASS | 791 passed, 41 skipped, 89.38% stmts / 90.13% lines (gate: 87%) |
+| 4 | Local Patch Coverage Report | PASS | 0 changed lines (dependency-only), 100% patch coverage |
+| 5 | Frontend Type Check (tsc --noEmit) | PASS | Zero TypeScript errors |
+| 6 | Pre-commit Hooks (lefthook) | PASS | All hooks passed (shellcheck, actionlint, dockerfile-check, YAML, EOF/whitespace) |
+| 7a | Trivy Filesystem Scan (CRITICAL/HIGH) | PASS | 0 vulnerabilities in source |
+| 7b | govulncheck (backend) | INFO | 2 findings — both `docker/docker` v28.5.2 with no upstream fix (pre-existing, documented in SECURITY.md) |
+| 7c | Docker Image Scan (Grype) | PASS | 0 CRITICAL, 2 HIGH (both unfixed Alpine OpenSSL), all target CVEs resolved |
+| 8 | Linting (make lint-fast) | PASS | 0 issues |
+| 9 | GORM Security Scan (--check) | PASS | 0 CRITICAL, 0 HIGH, 2 INFO suggestions |
+
+**Overall Status: PASS**
+
+---
+
+## Vulnerability Remediation Verification
+
+### Target CVEs — All Resolved
+
+All CVEs identified in the spec (`docs/plans/current_spec.md`) were verified as absent from the `charon:vuln-fix` image:
+
+| CVE / GHSA | Package | Was | Now | Status |
+|-----------|---------|-----|-----|--------|
+| CVE-2026-39883 | otel/sdk | v1.40.0 | v1.43.0 | Resolved |
+| CVE-2026-34986 | go-jose/v3 | v3.0.4 | v3.0.5 | Resolved |
+| CVE-2026-34986 | go-jose/v4 | v4.1.3 | v4.1.4 | Resolved |
+| CVE-2026-32286 | pgproto3/v2 | v2.3.3 | Not detected | Resolved |
+| GHSA-xmrv-pmrh-hhx2 | AWS SDK v2 (multiple) | various | Patched | Resolved |
+| CVE-2026-39882 | OTel HTTP exporters | v1.40.0–v1.42.0 | v1.43.0 | Resolved |
+| CVE-2026-32281/32288/32289 | Go stdlib | 1.26.1 | 1.26.2 | Resolved (via Dockerfile ARG) |
+
+### Remaining Vulnerabilities in Docker Image (Pre-existing, Unfixed Upstream)
+
+| Severity | CVE | Package | Version | Status |
+|----------|-----|---------|---------|--------|
+| HIGH | CVE-2026-31790 | libcrypto3, libssl3 | 3.5.5-r0 | Awaiting Alpine patch |
+| Medium | CVE-2025-60876 | busybox | 1.37.0-r30 | Awaiting Alpine patch |
+| Medium | GHSA-6jwv-w5xf-7j27 | go.etcd.io/bbolt | v1.4.3 | CrowdSec transitive dep |
+| Unknown | CVE-2026-28387/28388/28389/28390/31789 | libcrypto3, libssl3 | 3.5.5-r0 | Awaiting Alpine NVD scoring + patch |
+
+**Note**: CVE-2026-31790 (HIGH, OpenSSL) is a **new finding** not previously documented in SECURITY.md. It affects the Alpine 3.23.3 base image and has no fix available. It is **not introduced by this PR** — it would be present in any image built on Alpine 3.23.3. Recommend adding to SECURITY.md known vulnerabilities section.
+
+### govulncheck Findings (Backend Source — Pre-existing)
+
+| ID | Module | Fixed In | Notes |
+|----|--------|----------|-------|
+| GO-2026-4887 (CVE-2026-34040) | docker/docker v28.5.2 | N/A | Already in SECURITY.md |
+| GO-2026-4883 (CVE-2026-33997) | docker/docker v28.5.2 | N/A | Already in SECURITY.md |
+
+---
+
+## Coverage Details
+
+### Backend (Go)
+
+- Statement coverage: **88.2%**
+- Line coverage: **88.4%**
+- Gate threshold: 87% — **PASSED**
+
+### Frontend (React/TypeScript)
+
+- Statements: **89.38%**
+- Branches: **81.86%**
+- Functions: **86.71%**
+- Lines: **90.13%**
+- Gate threshold: 87% — **PASSED**
+
+### Patch Coverage
+
+- Changed source lines: **0** (dependency-only update)
+- Patch coverage: **100%**
+
+---
+
+## E2E Test Details
+
+Tests executed against `charon:vuln-fix` container on `http://127.0.0.1:8080`:
+
+| Browser | Shards | Passed | Skipped | Failed |
+|---------|--------|--------|---------|--------|
+| Firefox | 4/4 | 11 | 20 | 0 |
+| Chromium | 1/4 (spot) | 8 | 0 | 0 |
+
+Skipped tests are from the security suite (separate project configuration). No test failures observed. The full 3-browser suite will run in CI.
+
+---
+
+## GORM Scanner Details
+
+- Scanned: 43 Go files (2401 lines)
+- CRITICAL: 0
+- HIGH: 0
+- MEDIUM: 0
+- INFO: 2 (missing indexes on `UserPermittedHost` foreign keys — pre-existing, non-blocking)
+
+---
+
+## Recommendations
+
+1. **Add CVE-2026-31790 to SECURITY.md** — New HIGH OpenSSL vulnerability in Alpine base image. No fix available. Monitor Alpine security advisories.
+2. **Monitor docker/docker module migration** — 2 govulncheck findings with no upstream fix. Track moby/moby/v2 stabilization.
+3. **Monitor bbolt GHSA-6jwv-w5xf-7j27** — Medium severity in CrowdSec transitive dependency. Track CrowdSec updates.
+4. **Full CI E2E suite** — Local validation passed on Firefox + Chromium spot check. The complete 3-browser suite should run in CI pipeline.
+
+---
+
+## Conclusion
+
+All audit gates **PASS**. The dependency-only changes successfully remediate all 5 HIGH and 3 MEDIUM vulnerability groups identified in the spec. No regressions detected in tests, type safety, linting, or security scans. The remaining HIGH finding (CVE-2026-31790) is a pre-existing Alpine base image issue unrelated to this PR.
+
+**Verdict: Clear to merge.**
 # QA Security Audit Report

 | Field       | Value                          |
--- a/docs/reports/qa_report_2026-03-24.md
+++ b/docs/reports/qa_report_2026-03-24.md
@@ -0,0 +1,322 @@
+# QA Security Audit Report
+
+| Field       | Value                          |
+|-------------|--------------------------------|
+| **Date**    | 2026-03-24                     |
+| **Image**   | `charon:local` (Alpine 3.23.3) |
+| **Go**      | 1.26.1                         |
+| **Grype**   | 0.110.0                        |
+| **Trivy**   | 0.69.1                         |
+| **CodeQL**  | Latest (SARIF v2.1.0)          |
+
+---
+
+## Executive Summary
+
+The current `charon:local` image built on 2026-03-24 shows a significantly improved
+security posture compared to the CI baseline. Three previously tracked SECURITY.md
+vulnerabilities are now **resolved** due to Go 1.26.1 compilation and Alpine package
+updates. Two new medium/low findings emerged. No CRITICAL or HIGH active
+vulnerabilities remain in the unignored scan results.
+
+| Category               | Critical | High | Medium | Low | Total |
+|------------------------|----------|------|--------|-----|-------|
+| **Active (unignored)** | 0        | 0    | 4      | 2   | 6     |
+| **Ignored (documented)**| 0       | 4    | 0      | 0   | 4     |
+| **Resolved since last audit** | 1 | 4    | 1      | 0   | 6     |
+
+---
+
+## Scans Executed
+
+| # | Scan                          | Tool      | Result               |
+|---|-------------------------------|-----------|----------------------|
+| 1 | Trivy Filesystem              | Trivy     | 0 findings (no lang-specific files detected) |
+| 2 | Docker Image (SBOM + Grype)   | Syft/Grype| 6 active, 8 ignored  |
+| 3 | Trivy Image Report            | Trivy     | 1 HIGH (stale Feb 25 report; resolved in current build) |
+| 4 | CodeQL Go                     | CodeQL    | 1 finding (false positive — see below) |
+| 5 | CodeQL JavaScript             | CodeQL    | 0 findings           |
+| 6 | GORM Security Scanner         | Custom    | PASSED (0 issues, 2 info) |
+| 7 | Lefthook / Pre-commit         | Lefthook  | Configured (project uses `lefthook.yml`, not `.pre-commit-config.yaml`) |
+
+---
+
+## Active Findings (Unignored)
+
+### CVE-2025-60876 — BusyBox wget HTTP Request Smuggling
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | Medium (CVSS 6.5) |
+| **Package**      | `busybox` 1.37.0-r30 (Alpine APK) |
+| **Affected**     | `busybox`, `busybox-binsh`, `busybox-extras`, `ssl_client` (4 matches) |
+| **Fix Available** | No |
+| **Classification** | AWAITING UPSTREAM |
+| **EPSS**         | 0.00064 (0.20 percentile) |
+
+**Description**: BusyBox wget through 1.37 accepts raw CR/LF and other C0 control bytes
+in the HTTP request-target, allowing request line splitting and header injection (CWE-284).
+
+**Risk Assessment**: Low practical risk. Charon does not invoke `busybox wget` in its
+application logic. The vulnerable `wget` applet would need to be manually invoked inside
+the container with attacker-controlled URLs.
+
+**Remediation**: Monitor Alpine 3.23 for a patched `busybox` APK. No action required
+until upstream ships a fix.
+
+---
+
+### CVE-2026-26958 / GHSA-fw7p-63qq-7hpr — edwards25519 MultiScalarMult Invalid Results
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | Low (CVSS 1.7) |
+| **Package**      | `filippo.io/edwards25519` v1.1.0 |
+| **Location**     | CrowdSec binaries (`/usr/local/bin/crowdsec`, `/usr/local/bin/cscli`) |
+| **Fix Available** | v1.1.1 |
+| **Classification** | AWAITING UPSTREAM |
+| **EPSS**         | 0.00018 (0.04 percentile) |
+
+**Description**: `MultiScalarMult` produces invalid results or undefined behavior if
+the receiver is not the identity point. This is a rarely used, advanced API.
+
+**Risk Assessment**: Minimal. CrowdSec does not directly expose edwards25519
+`MultiScalarMult` to external input. The fix exists at v1.1.1 but requires CrowdSec
+to rebuild with the updated dependency.
+
+**Remediation**: Awaiting CrowdSec upstream release with updated dependency. No
+action available for Charon maintainers.
+
+---
+
+## Ignored Findings (Documented with Justification)
+
+These findings are suppressed in the Grype configuration with documented risk
+acceptance rationale. All are in third-party binaries bundled in the container;
+none are in Charon's own code.
+
+### CVE-2026-2673 — OpenSSL TLS 1.3 Key Exchange Group Downgrade
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | High (CVSS 7.5) |
+| **Package**      | `libcrypto3` / `libssl3` 3.5.5-r0 |
+| **Matches**      | 2 (libcrypto3, libssl3) |
+| **Classification** | ALREADY DOCUMENTED · AWAITING UPSTREAM |
+
+Charon terminates TLS at the Caddy layer; the Go backend does not act as a raw
+TLS 1.3 server. Alpine 3.23 still ships 3.5.5-r0. Risk accepted pending Alpine patch.
+
+---
+
+### GHSA-6g7g-w4f8-9c9x — DoS in buger/jsonparser (CrowdSec)
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | High (CVSS 7.5) |
+| **Package**      | `github.com/buger/jsonparser` v1.1.1 |
+| **Matches**      | 2 (crowdsec, cscli binaries) |
+| **Fix Available** | v1.1.2 |
+| **Classification** | ALREADY DOCUMENTED · AWAITING UPSTREAM |
+
+Charon does not use this package directly. The vector requires reaching CrowdSec's
+internal JSON processing pipeline. Risk accepted pending CrowdSec upstream fix.
+
+---
+
+### GHSA-jqcq-xjh3-6g23 / GHSA-x6gf-mpr2-68h6 / CVE-2026-4427 — DoS in pgproto3/v2 (CrowdSec)
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | High (CVSS 7.5) |
+| **Package**      | `github.com/jackc/pgproto3/v2` v2.3.3 |
+| **Matches**      | 4 (2 GHSAs × 2 binaries) |
+| **Fix Available** | No (v2 is archived/EOL) |
+| **Classification** | ALREADY DOCUMENTED · AWAITING UPSTREAM |
+
+pgproto3/v2 is archived with no fix planned. CrowdSec must migrate to pgx/v5.
+Charon uses SQLite, not PostgreSQL; this code path is unreachable in standard
+deployment.
+
+---
+
+## Resolved Findings (Since Last SECURITY.md Update)
+
+The following vulnerabilities documented in SECURITY.md are no longer detected in the
+current image build. **SECURITY.md should be updated to move these to "Patched
+Vulnerabilities".**
+
+### CVE-2025-68121 — Go Stdlib Critical in CrowdSec (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | Critical |
+| **Resolution**   | CrowdSec binaries now compiled with Go 1.26.1 (was Go 1.25.6) |
+| **Verified**     | Not detected in Grype scan of current image |
+
+---
+
+### CHARON-2025-001 — CrowdSec Go Stdlib CVE Cluster (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | High |
+| **Aliases**      | CVE-2025-58183, CVE-2025-58186, CVE-2025-58187, CVE-2025-61729, CVE-2026-25679, CVE-2025-61732, CVE-2026-27142, CVE-2026-27139 |
+| **Resolution**   | CrowdSec binaries now compiled with Go 1.26.1 |
+| **Verified**     | None of the aliased CVEs detected in Grype scan |
+
+---
+
+### CVE-2026-27171 — zlib CPU Exhaustion (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | Medium |
+| **Resolution**   | Alpine now ships `zlib` 1.3.2-r0 (fix threshold: 1.3.2) |
+| **Verified**     | Not detected in Grype scan; zlib 1.3.2-r0 confirmed in SBOM |
+
+---
+
+### CVE-2026-33186 — gRPC-Go Authorization Bypass (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | Critical |
+| **Packages**     | `google.golang.org/grpc` v1.74.2 (CrowdSec), v1.79.1 (Caddy) |
+| **Resolution**   | Upstream releases now include patched gRPC (>= v1.79.3) |
+| **Verified**     | Not detected in Grype scan; ignore rule present but no match |
+
+---
+
+### GHSA-69x3-g4r3-p962 / CVE-2026-25793 — Nebula ECDSA Malleability (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | High |
+| **Package**      | `github.com/slackhq/nebula` v1.9.7 in Caddy |
+| **Resolution**   | Caddy now ships with nebula >= v1.10.3 |
+| **Verified**     | Not detected in Grype scan; Trivy image report from Feb 25 had this but current build does not |
+
+> **Note**: The stale Trivy image report (`trivy-image-report.json`, dated 2026-02-25) still
+> shows CVE-2026-25793. This report predates the current build and should be regenerated.
+
+---
+
+### GHSA-479m-364c-43vc — goxmldsig XML Signature Bypass (RESOLVED)
+
+| Field            | Value |
+|------------------|-------|
+| **Previous Severity** | High |
+| **Package**      | `github.com/russellhaering/goxmldsig` v1.5.0 in Caddy |
+| **Resolution**   | Caddy now ships with goxmldsig >= v1.6.0 |
+| **Verified**     | Not detected in Grype scan; ignore rule present but no match |
+
+---
+
+## CodeQL Analysis
+
+### go/cookie-secure-not-set — FALSE POSITIVE
+
+| Field            | Value |
+|------------------|-------|
+| **Severity**     | Medium (CodeQL) |
+| **File**         | `backend/internal/api/handlers/auth_handler.go:152` |
+| **Classification** | FALSE POSITIVE (stale SARIF) |
+
+**Finding**: CodeQL reports "Cookie does not set Secure attribute to true" at line 152.
+
+**Verification**: The `setSecureCookie` function at line 148-156 calls `c.SetCookie()`
+with `secure: true` (6th positional argument). The Secure attribute IS set correctly.
+This SARIF was generated from a previous code version and does not reflect the current
+source. **The CodeQL SARIF files should be regenerated.**
+
+### JavaScript / JS
+
+No findings. Both `codeql-results-javascript.sarif` and `codeql-results-js.sarif` contain
+0 results.
+
+---
+
+## GORM Security Scanner
+
+| Metric     | Value |
+|------------|-------|
+| **Result** | PASSED |
+| **Files**  | 43 Go files (2,396 lines) |
+| **Critical** | 0 |
+| **High**   | 0 |
+| **Medium** | 0 |
+| **Info**   | 2 (missing indexes on foreign keys in `UserPermittedHost`) |
+
+The 2 informational suggestions (`UserID` and `ProxyHostID` missing `gorm:"index"` in
+`backend/internal/models/user.go:130-131`) are performance recommendations, not security
+issues. They do not block this audit.
+
+---
+
+## CI vs Local Scan Discrepancy
+
+The CI reported **3 Critical, 5 High, 1 Medium**. The local scan on the freshly built
+image reports **0 Critical, 0 High, 4 Medium, 2 Low** (active) plus **4 High** (ignored).
+
+**Root causes for the discrepancy:**
+
+1. **Resolved vulnerabilities**: 3 Critical and 4 High findings were resolved by Go 1.26.1
+   compilation and upstream Caddy/CrowdSec dependency updates since the CI image was built.
+2. **Grype ignore rules**: The local scan applies documented risk acceptance rules that
+   suppress 4 High findings in third-party binaries. CI (Trivy) does not use these rules.
+3. **Stale CI artifacts**: The `trivy-image-report.json` dates from 2026-02-25 and does
+   not reflect the current image state. The `codeql-results-go.sarif` references code that
+   has since been fixed.
+
+---
+
+## Recommended Actions
+
+### Immediate (This Sprint)
+
+1. **Update SECURITY.md**: Move CVE-2025-68121, CHARON-2025-001, and CVE-2026-27171 to
+   a "Patched Vulnerabilities" section. Add CVE-2025-60876 and CVE-2026-26958 as new
+   known vulnerabilities.
+
+2. **Regenerate stale scan artifacts**: Re-run Trivy image scan and CodeQL analysis to
+   produce current SARIF/JSON files. The existing files predate fixes and produce
+   misleading CI results.
+
+3. **Clean up Grype ignore rules**: Remove ignore entries for vulnerabilities that are
+   no longer detected (CVE-2026-33186, GHSA-69x3-g4r3-p962, GHSA-479m-364c-43vc).
+   Stale ignore rules obscure the actual security posture.
+
+### Next Release
+
+4. **Monitor Alpine APK updates**: Watch for patched `busybox` (CVE-2025-60876) and
+   `openssl` (CVE-2026-2673) packages in Alpine 3.23.
+
+5. **Monitor CrowdSec releases**: Watch for CrowdSec builds with updated
+   `filippo.io/edwards25519` >= v1.1.1, `buger/jsonparser` >= v1.1.2, and
+   `pgx/v5` migration (replacing pgproto3/v2).
+
+6. **Monitor Go 1.26.2-alpine**: When available, bump `GO_VERSION` to pick up any
+   remaining stdlib patches.
+
+### Informational (Non-Blocking)
+
+7. **GORM indexes**: Consider adding `gorm:"index"` to `UserID` and `ProxyHostID` in
+   `UserPermittedHost` for query performance.
+
+---
+
+## Gotify Token Review
+
+Verified: No Gotify application tokens appear in scan output, log artifacts, test results,
+API examples, or URL query parameters. All diagnostic output is clean.
+
+---
+
+## Conclusion
+
+The Charon container image security posture has materially improved. Six previously known
+vulnerabilities are now resolved through Go toolchain and dependency updates. The remaining
+active findings are medium/low severity, reside in Alpine base packages and CrowdSec
+third-party binaries, and have no available fixes. No vulnerabilities exist in Charon's
+own application code. GORM and CodeQL scans confirm the backend code is clean.