Athena appliance 0.8.1
Released 2026/10/19 · Feature release. Production-signed update for appliances on 0.7.0 or later. No new VHDX/OVA images in this release: new installs use the 0.7.0 images and apply this bundle.
Downloads#
| File | Size | SHA-256 |
|---|---|---|
athena-update-0.8.1.tarUpdate bundle for existing appliances | 886.7 MB (929,730,560 bytes) | 8c486cc879cb12937d527e44a645e9f0eff92a452ce11703e5c1ce0d03c77d5e |
athena-0.8.1-sbom.zipSPDX 2.3 JSON SBOMs + CVE report | 2,761 KB | 12a2831aab3561f6f1d027c722e882c96446dd0306bd61ba024741b805ecb10c |
New installation: download the 0.7.0 appliance image, then apply this bundle.
Update bundles are signed with the Athena update key, and the appliance verifies the signature and every file hash
before it changes anything. Signing key fingerprint (SHA-256 of the public key, first 16 hex): b21ce6334a281ebf.
What is inside#
| Component | Version |
|---|---|
| Athena server | 0.8.1 (image athena-server:appliance-e2d86917, ASP.NET Core runtime 8.0.32) |
| Flatcar Container Linux (Stable) | 4757.2.1 · kernel 6.12.111, Docker 28.2.2 (unchanged from 0.7.0) |
| PostgreSQL (optional, off by default) | 16.15 (unchanged; not carried in this bundle) |
| Windows / Linux / macOS agent | 1.2.144 / 1.2.126 / 1.2.133 |
| Remote helper | 1.3.28 |
| PowerShell module / HermesCLI | 2.17.0 / 1.2.26 |
Upgrade path#
- From 0.7.0 and later: upload
athena-update-0.8.1.tarin Settings → Appliance → Appliance updates (or the appliance console, 13) Updates), then Verify and Apply. The appliance backs up the database and rolls back on its own if the new version does not stay healthy. Watch it. - This is a full bundle only (no delta): appliances on 0.7.0 cannot apply delta bundles.
- PostgreSQL is not in the bundle; the appliance keeps its own PostgreSQL 16.15 image, which is the version this release needs.
- The bundled agents (Windows 1.2.144, Linux 1.2.126, macOS 1.2.133) and remote helper 1.3.28 are registered automatically on the first start after the update, also when the admin password was changed. Agents themselves are not updated automatically: roll out the new agent from the web console.
- Downgrades are not supported.
Security fixes#
- Athena server image: ASP.NET Core runtime 8.0.31 → 8.0.32 (GHSA-fpq8-4vhr-rcxx, GHSA-rv87-ccxw-8ggf, both Critical).
- No OS change in this release (Flatcar 4757.2.1, as in 0.7.0).
CVE report summary#
Every release is scanned for known vulnerabilities (CVEs) in everything it ships, including the third-party operating system and libraries underneath Athena. Scanned 2026/10/19 with grype v0.119.0 (database built 2026/10/18), after removing findings proven not reachable on the appliance. Full report: SBOM download.
| Component | Where it comes from | Critical | High | Medium | Low | Fix available |
|---|---|---|---|---|---|---|
| Athena server image | Ubuntu 24.04 packages in Microsoft's official .NET 8 base image (glibc, zlib, ICU) | 0 | 0 | 7 | 1 | 0 |
| Agents and helper | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Appliance files | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Flatcar OS (kernel + Go components) | Flatcar Container Linux 4757.2.1, the appliance's operating system | 19 | 227 | 403 | 29 | 605 |
How to read this
- Athena's own code has no known vulnerabilities: the agents, the helper and the appliance files show 0. A release is blocked if anything SealGrid builds has a Critical finding with a fix available.
- The server image findings (7 Medium, 1 Low) come from the operating-system libraries in Microsoft's .NET base image, the same ones every .NET 8 application on Ubuntu 24.04 carries. Ubuntu has not released fixes for them yet ("Fix available: 0"); they are picked up automatically by the first Athena build after Ubuntu ships them.
- The Flatcar findings are fixed in newer Flatcar releases and reach your appliance as part of a future signed Athena update bundle. Kernel findings are matched by version number (NVD CPE), so they are an upper bound: a match means the kernel version is listed, not that the vulnerable part is in use on the appliance. Flatcar's own packages (glibc, OpenSSL, systemd, …) are tracked in Flatcar's security advisories for 4757.2.1.
- Exposure is limited by design: the firewall opens only Athena's own ports (web console, agents, and the built-in remote-control server, which you can switch off), the OS is read-only and verified, and the server runs as a non-root, read-only container confined by SELinux. See Security and hardening.
Changes#
New
- Athena Agent Properties in Windows Control Panel. The agent registers a Control Panel item that opens the remote helper's properties window: status, the policies applied to the machine, the local cache, and local actions. Every local action is audited on the server as its own event type, filterable on the Audit page.
- Shortcuts module (Policies → Shortcuts). Desktop, Start menu and link shortcuts on Windows (.lnk/.url),
Linux (.desktop) and macOS (Dock/alias), with Create / Replace / Update / Delete, for all users, every profile, or at sign-in.
One policy wins per agent; the agent removes only shortcuts Athena created. Licensed as
module.shortcuts; PowerShell cmdlets in module 2.17.0. - Reveal a Secret credential. A new permission,
credentials.reveal(Helpdesk, Operator, Admin), adds an eye button on Secret credentials (andPOST api/credentials/{id}/reveal). Each reveal is confirmed, shown for 30 seconds and audited (CredentialSecretRevealed); it fails closed if the audit cannot be written. Local and Domain passwords stay write-only. - BIOS administrator password: set, change, remove, with escrow. From an agent's BIOS tab
(
bios.password, Admin,module.bios) on Dell, HP and Lenovo. The password is held in a Secret credential, and the agent records which one (escrow); BIOS Remediate uses the escrowed password by default. - Profile page layout. API tokens are panel 03, permissions panel 04; panels 01 and 02 share a height.
Fixed
- Commands sent to an offline or disconnected agent, and commands that target only a tag, now finish instead of staying "Running" forever.
- The agent update badge clears when the update completes, names the target version, survives a page reload, and stays visible when the update failed; the agent details page shows the same badge.
- File pickers (HP BIOS password file, Sysmon config upload, Sync trusted CA, appliance web certificate) use the themed Browse button.
- Appliance: the bundled agents and remote helper are registered by the server itself after an update. Before
this, they were uploaded with the initial admin password, so on an appliance whose admin password was changed no update ever
delivered new agents. The PowerShell module and HermesCLI downloads (
/downloads/…) work again (they answered 404 under SELinux enforcing). - Appliance console: the initial admin password is no longer shown after an emergency password reset.
Known issues
- Older trial licences do not unlock the new modules. An update never replaces an installed licence. An appliance still on an older trial licence keeps BIOS, Restart Policies and Shortcuts switched off until a current licence is uploaded in Settings → License.
- The BIOS password actions have not been run against real hardware yet.
Documentation#
- Installation and the Beginner Guide (with videos)
- Security and hardening and how updates work
- Newer release: 0.9.1
- Original release notes: RELEASE-NOTES-0.8.1.md