Skip to content

v0.3.1

Latest
Latest

Choose a tag to compare

View all tags
@NotYuSheng NotYuSheng released this 24 Oct 07:49
v0.3.1
cc87099
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TracePcap v0.3.1 is a security release. It fixes CVE-2026-18963, a critical (CVSS 9.1) authentication bypass in Keycloak's reset-credentials flow that has a public proof-of-concept exploit. Upgrade any deployment that uses login (the prod / offline-prod overlays).

Deployments without login (plain docker-compose.yml or docker-compose.offline.yml with no auth overlay) don't run Keycloak and aren't affected. Update them as usual.

🔒 Security

  • Keycloak 26.0 → 26.7.5 (fixes CVE-2026-18963)
  • Keycloak now runs in production mode (start) instead of start-dev. It keeps the same embedded data store, so existing users and credentials carry over unchanged.
  • The Trivy image scan now covers the bundled Keycloak image

All in #847

⬆️ How to upgrade

Upgrading is in place. Existing Keycloak data is kept, including users created in the admin console. No .env changes are needed.

1. Back up Keycloak's data (strongly recommended)

scripts/backup.sh does not cover Keycloak, so take this backup by hand. Run it from the repo directory:

# Online deployment:
COMPOSE="docker compose -f docker-compose.yml -f docker-compose.prod.yml"
# Air-gapped deployment:
# COMPOSE="docker compose -f docker-compose.offline.yml -f docker-compose.offline-prod.yml"

$COMPOSE stop keycloak
docker cp tracepcap-keycloak:/opt/keycloak/data/h2 ./keycloak-backup-$(date +%F)
ls ./keycloak-backup-$(date +%F)     # expect keycloakdb.mv.db

Login is unavailable while Keycloak is stopped. The analysis stack keeps running.

2a. Online deployment

git fetch --tags
git checkout v0.3.1
docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build

2b. Air-gapped deployment

On a connected machine:

git fetch --tags && git checkout v0.3.1
INCLUDE_KEYCLOAK=true bash scripts/pull-and-save-images.sh

Copy the new images/, docker-compose.offline.yml, docker-compose.offline-prod.yml, keycloak/realm-export.json and scripts/load-images.sh to the offline host. You must re-save the images: the old tarballs contain Keycloak 26.0, and the offline host can't pull 26.7.5 itself. Then, on the offline host:

bash scripts/load-images.sh
PUBLIC_URL=http://<host>:8888 \
  docker compose -f docker-compose.offline.yml -f docker-compose.offline-prod.yml up -d

3. Verify

docker logs tracepcap-keycloak 2>&1 | grep -E "Keycloak 26.7.5|Profile prod activated|ERROR"

You should see Keycloak 26.7.5 ... started and Profile prod activated, with no ERROR lines. The first start after the upgrade takes a little longer than usual while Keycloak migrates its data and rebuilds its configuration. Then sign in to the app as usual and confirm your existing accounts still work.

Rolling back

To return to v0.3.0, restore the backup from step 1:

$COMPOSE stop keycloak
git checkout v0.3.0
$COMPOSE up --no-start keycloak
docker cp ./keycloak-backup-<date>/. tracepcap-keycloak:/opt/keycloak/data/h2/
$COMPOSE up -d

This puts back exactly the pre-upgrade data. Any accounts created after the upgrade are lost. Rolling back reintroduces CVE-2026-18963, so use it only as an emergency measure.

If you have no backup, 26.0 does start on the upgraded data, and logins worked in testing. Keycloak flags this as unsupported (Possibly incorrect state of migration), though, so treat it as a last resort.

⚠️ Known issue

  • OpenJDK CVE-2026-91403 (CVSS 9.1): the backend's Java runtime (Temurin 21.0.12.1) is affected. A patched eclipse-temurin:21-jre-jammy image hasn't been published yet. When it is, rebuild with docker compose build --pull backend. No code change or new TracePcap release is needed.

Full Changelog: v0.3.0...v0.3.1

Assets 2
Loading