Athena appliance 0.9.1
Released 2026/10/21 · Feature release. New VHDX/OVA appliance images, and a production-signed update bundle for appliances on 0.7.0 or later.
Downloads#
| File | Size | SHA-256 |
|---|---|---|
athena-appliance.ovaVMware appliance image | 1.1 GB (1,138,216,960 bytes) | ac7ee306d09015f19df671c0306c9623d2cfd1cacb1bac405c646d0757059182 |
athena-appliance.vhdxHyper-V appliance image | 1.6 GB (1,719,664,640 bytes) | 36d5a61a1a3baec611d7124d62f74d9b60036b6828dcf8410b6401185d5fb4d7 |
athena-update-0.9.1.tarUpdate bundle for existing appliances | 915.1 MB (959,559,680 bytes) | 12d2729376f9775cd6d7502e1ecbae095abb1a89ed7a0be0284a45ed6b31d2c5 |
athena-0.9.1-sbom.zipSPDX 2.3 JSON SBOMs + CVE report | 2,947 KB | c0aec22e392dbd892e31f1ab14c803ebec2bd9b21cbbdc99c2e11a8f20dfc551 |
New installation: download the 0.9.1 appliance image; no update is needed.
Checksums for all files: SHA256SUMS. The images carry a trial licence valid until 2027/04/18.
Update bundles are signed with the Athena update key, and the appliance verifies the signature and every file hash
before it changes anything. Signing key fingerprint (SHA-256 of the public key, first 16 hex): b21ce6334a281ebf.
What is inside#
| Component | Version |
|---|---|
| Athena server | 0.9.1 (image athena-server:appliance-59f5a70d, .NET 10, ASP.NET Core runtime 10.0.13) |
| Flatcar Container Linux (Stable) | 4757.2.1 · kernel 6.12.111, Docker 28.2.2 (unchanged) |
| PostgreSQL (optional, off by default) | 16.15 (unchanged; not carried in this bundle) |
| Windows / Linux / macOS agent | 1.2.152 / 1.2.134 / 1.2.141 |
| Remote helper | 1.3.31 |
| PowerShell module / HermesCLI | 2.17.0 / 1.2.27 |
Upgrade path#
- From 0.7.0 or 0.8.1: upload
athena-update-0.9.1.tarin Settings → Appliance → Appliance updates (or the appliance console, 13) Updates), then Verify and Apply. The appliance backs up the database and rolls back on its own if the new version does not stay healthy. Watch it. - This is a full bundle only (no delta).
- PostgreSQL is not in the bundle; the appliance keeps its own PostgreSQL 16.15 image, which is the version this release needs.
- The bundled agents (Windows 1.2.152, Linux 1.2.134, macOS 1.2.141) and remote helper 1.3.31 are registered automatically on the first start after the update. The appliance update itself does not change the agents on your endpoints: roll out the new agent from the web console.
- Downgrades are not supported.
Platform and security#
- The Athena server and its images move to .NET 10 (runtime 10.0.13), on Microsoft's chiseled Ubuntu 24.04
base image (
aspnet:10.0-noble-chiseled-extra). - No OS change in this release (Flatcar 4757.2.1, as in 0.7.0 and 0.8.1).
CVE report summary#
Every release is scanned for known vulnerabilities (CVEs) in everything it ships, including the third-party operating system and libraries underneath Athena. Scanned 2026/10/21 with grype v0.119.0 (database built 2026/10/20), after removing findings proven not reachable on the appliance. Full report: SBOM download.
| Component | Where it comes from | Critical | High | Medium | Low | Fix available |
|---|---|---|---|---|---|---|
| Athena server image | Ubuntu 24.04 libraries in Microsoft's official .NET 10 base image (glibc, ICU) | 0 | 0 | 6 | 1 | 0 |
| Agents and helper | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Appliance files | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Flatcar OS (kernel + Go components) | Flatcar Container Linux 4757.2.1, the appliance's operating system | 19 | 227 | 403 | 29 | 702 |
How to read this
- Athena's own code has no known vulnerabilities: the agents, the helper and the appliance files show 0. A release is blocked if anything SealGrid builds has a Critical finding with a fix available.
- The server image findings (6 Medium, 1 Low) come from two operating-system libraries (glibc and ICU) in Microsoft's .NET base image, the same ones every .NET application on Ubuntu 24.04 carries. Ubuntu has not released fixes for them yet ("Fix available: 0"); they are picked up automatically by the first Athena build after Ubuntu ships them.
- The Flatcar findings are fixed in newer Flatcar releases and reach your appliance as part of a future signed Athena update bundle. The Flatcar counts are the same as in 0.8.1; "Fix available" is higher only because the newer scan database knows of more fixes. Kernel findings are matched by version number (NVD CPE), so they are an upper bound: a match means the kernel version is listed, not that the vulnerable part is in use on the appliance. Flatcar's own packages (glibc, OpenSSL, systemd, …) are tracked in Flatcar's security advisories for 4757.2.1.
- Exposure is limited by design: the firewall opens only Athena's own ports (web console, agents, and the built-in remote-control server, which you can switch off), the OS is read-only and verified, and the server runs as a non-root, read-only container confined by SELinux. See Security and hardening.
Changes#
New
- Safer agent self-update. The agent checks the new build's hash before it swaps it in, then tests the new build. If that fails, it rolls back by itself on Windows, Linux and macOS, and never retries a build that failed on that machine. Every step is logged as Event Log / syslog events 102–105. It works with Tamper Protection on, on all three systems.
- "Update rolled back" badge. An amber badge on the agent shows when an agent update was rolled back.
- Install agent for Helpdesk. The Install agent button on the Agents page has its own permission,
agents.install, included in the Helpdesk role. - Unattended macOS install. The macOS installer runs without prompts when
ATHENA_REGISTRATION_TOKENis set. - More in Athena Agent Properties (Windows Control Panel): rows for Sysmon, BIOS, and live Tamper Protection status.
Fixed
- Agent auto-update: a version the agent already runs is no longer pushed again; a dropped transfer is retried; an update applied after the machine slept is reported as Completed; the helper and CLI are no longer downloaded again on every connect.
- Remote control: viewer reconnect, cursor and consent fixes. Consent is now enforced by the server, and a consent timeout is reported as its own outcome.
- An agent no longer shows as Online after its connection was replaced.
- Windows inventory no longer loses network adapters when one adapter has IPv4 unbound.
Known issues
- Appliances first installed from the 0.7.0 image keep their older trial licence. An update never replaces an installed licence, so they keep BIOS, Restart Policies and Shortcuts switched off until a current licence is uploaded in Settings → License. The 0.9.1 images include a trial licence with all modules on.
- Updating from 0.7.0 leaves the bundle on the appliance. The 0.7.0 updater does not remove a bundle after it is applied. Delete it once under Settings → Appliance → Appliance updates: click the trash icon on the bundle's row, then Delete. From 0.9.1 on, a successful update removes its bundle automatically.
Documentation#
- Installation and the Beginner Guide (with videos)
- Security and hardening and how updates work
- Previous release: 0.8.1