Athena appliance 0.9.3
Released 2026/10/27 · Feature and security release. A production-signed update bundle for existing appliances; there are no new appliance images.
Downloads#
| File | Size | SHA-256 |
|---|---|---|
athena-update-0.9.3.tarUpdate bundle for existing appliances | 924.8 MB (969,738,240 bytes) | efdd6e3e5bf4018f64381a36df64bf880f16f24cd9050fd3fb166cb2bed29c54 |
athena-0.9.3-sbom.zipSPDX 2.3 JSON SBOMs + CVE report | 2,769 KB | 74863abe5975b9b85c88fab13e26961e741eb6882ddb6518f16a44645b971adc |
New installation: download the 0.9.1 appliance image, then apply this bundle.
Checksums for all files: SHA256SUMS.
Update bundles are signed with the Athena update key, and the appliance verifies the signature and every file hash
before it changes anything. Signing key fingerprint (SHA-256 of the public key, first 16 hex): b21ce6334a281ebf.
What is inside#
| Component | Version |
|---|---|
| Athena server | 0.9.3 (image athena-server:appliance-08e13d51, .NET 10, ASP.NET Core runtime 10.0.13, Azure Linux 3.0 base) |
| Flatcar Container Linux (Stable) | 4757.2.2 · kernel 6.12.113, Docker 28.2.2, containerd 2.2.5 |
| PostgreSQL (optional, off by default) | 16.15 (unchanged; not carried in this bundle) |
| Windows / Linux / macOS agent | 1.2.157 / 1.2.138 / 1.2.145 |
| Remote helper | 1.3.31 |
| PowerShell module / HermesCLI | 2.18.1 / 1.2.28 |
Upgrade path#
- From 0.9.1: upload
athena-update-0.9.3.tarin Settings → Appliance → Appliance updates (or the appliance console, 13) Updates), then Verify and Apply. The appliance backs up the database and rolls back on its own if the new version does not stay healthy. Watch it. - This is a full bundle only (no delta), because the server base image changed.
- The bundle carries the Flatcar 4757.2.2 OS update; the application and the OS are updated together.
- PostgreSQL is not in the bundle; the appliance keeps its own PostgreSQL 16.15 image, which is the version this release needs.
- The bundled agents (Windows 1.2.157, Linux 1.2.138, macOS 1.2.145) and remote helper 1.3.31 are registered automatically on the first start after the update. The appliance update itself does not change the agents on your endpoints: roll out the new agent from the web console.
- Downgrades are not supported.
Platform and security#
- The Athena server image moves to Microsoft's Azure Linux 3.0 distroless base image for .NET 10. Its operating-system libraries now show no known vulnerabilities (0.9.1: 6 Medium, 1 Low).
- Flatcar moves from 4757.2.1 to 4757.2.2 (kernel 6.12.113), with Flatcar's security fixes for the Linux kernel, Go and ca-certificates.
- On the agent port (8444), agents trust only the Athena certificate authority they enrolled with and refuse a swapped CA. Package deployments now require a file hash, which the agent checks before it runs anything.
- A registration token's use is counted before any certificate is issued, so one token cannot enrol more devices than it allows.
CVE report summary#
Every release is scanned for known vulnerabilities (CVEs) in everything it ships, including the third-party operating system and libraries underneath Athena. Scanned 2026/10/27 with grype v0.119.0 (database built 2026/10/27), after removing findings proven not reachable on the appliance. Full report: SBOM download.
| Component | Where it comes from | Critical | High | Medium | Low | Fix available |
|---|---|---|---|---|---|---|
| Athena server image | Microsoft's Azure Linux 3.0 .NET 10 base image | 0 | 0 | 0 | 0 | 0 |
| Agents and helper | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Appliance files | SealGrid | 0 | 0 | 0 | 0 | 0 |
| Flatcar OS (kernel + Go components) | Flatcar Container Linux 4757.2.2, the appliance's operating system | 19 | 235 | 399 | 29 | 605 |
How to read this
- Everything SealGrid builds, and the server image, show 0. A release is blocked if anything SealGrid builds has a Critical finding with a fix available.
- The Flatcar findings are fixed in newer Flatcar releases and reach your appliance as part of a future signed Athena update bundle. Kernel findings are matched by version number (NVD CPE), so they are an upper bound: a match means the kernel version is listed, not that the vulnerable part is in use on the appliance. Flatcar's own packages (glibc, OpenSSL, systemd, …) are tracked in Flatcar's security advisories for 4757.2.2. 9 further Flatcar findings have no severity assigned yet.
- Exposure is limited by design: the firewall opens only Athena's own ports (web console, agents, and the built-in remote-control server, which you can switch off), the OS is read-only and verified, and the server runs as a non-root, read-only container confined by SELinux. See Security and hardening.
Changes#
New
- RustDesk policies. RustDesk remote-control settings are now managed as ordered policies under Policies → RustDesk, with an editor that previews what each operating system receives. They replace the previous fleet-wide RustDesk settings. Each agent gets its own effective policy when it connects and whenever a policy changes.
- RustDesk Policy tab on each agent. Shows the effective policy, whether the device has applied it, and any option that drifted from it (read back from the agent on Windows, Linux and macOS). Re-apply sends the policy to that one agent again.
- PowerShell module 2.18.1 with cmdlets for RustDesk policies, including
Sync-AthenaRustDeskPolicy. - Search agents by MAC address, with any separator (or none).
- The sign-in page shows the appliance version.
Fixed
- Scheduled package deployments now start when they fall due.
- RustDesk password rotation now runs on schedule. A new password is stored only after the agent confirms it, agents that missed a rotation are rotated when they reconnect, and failures are audited.
- LDAP / Active Directory: sign-in works on the appliance, the configured LDAP CA certificate is trusted and StartTLS works. Test connection says “could not reach” when nothing is listening.
- An agent self-update no longer stays Queued on a Windows machine in Modern Standby.
- System Health no longer reports a task that is not yet due as overdue, and the jobs tile no longer breaks for a recurring task that has never succeeded.
- Audit log: package create/edit/delete is recorded, and a manually started deployment is recorded under the user who started it.
- A registration token's use is given back when enrolment is refused for licensing reasons.
Known issues
- RustDesk policies need a licence that includes the RustDesk module. An update never replaces an installed licence, and the trial licence in the 0.9.1 images predates the module, so on those appliances RustDesk policies cannot be changed until a current licence is uploaded in Settings → License. Ask support@sealgrid.ai for one.
Documentation#
- Installation and the Beginner Guide (with videos)
- Security and hardening and how updates work
- Previous release: 0.9.1