Athena appliance 0.9.4

Released 2026/11/05 · Build 2225d429 · Feature and security release. A production-signed delta update bundle for appliances on 0.9.3; there are no new appliance images.

Downloads#

New installation: download the 0.9.1 appliance image, apply the 0.9.3 bundle, then this one. Checksums for all files: SHA256SUMS. Update bundles are signed with the Athena update key, and the appliance verifies the signature and every file hash before it changes anything. Signing key fingerprint (SHA-256 of the public key, first 16 hex): b21ce6334a281ebf.

What is inside#

Upgrade path#

• From 0.9.3: upload athena-update-0.9.4-delta-from-0.9.3.tar in Settings → Appliance → Appliance updates (or the appliance console, 13) Updates), then Verify and Apply. The appliance backs up the database and rolls back on its own if the new version does not stay healthy. Watch it.
• From 0.9.1: apply the 0.9.3 bundle first, then this one.
• This is a delta bundle: it carries only the server image layers that changed since 0.9.3, so it works only on an appliance running 0.9.3.
• The bundle carries the Flatcar 4757.2.3 OS update; the application and the OS are updated together.
• PostgreSQL is not in the bundle; the appliance keeps its own PostgreSQL 16.15 image, which is the version this release needs.
• The bundled agents (Windows 1.2.178, Linux 1.2.152, macOS 1.2.156) and remote helper 1.3.33 are registered automatically on the first start after the update. The appliance update itself does not change the agents on your endpoints: roll out the new agent from the web console.
• The agent gateway now allows 50 connections per source address by default. If many agents reach it through one NAT address, raise MaxConnectionsPerIp before you upgrade. See Agent Gateway.
• Downgrades are not supported.

Platform and security#

• Flatcar moves from 4757.2.2 to 4757.2.3 (kernel 6.12.114).
• Endpoints need only the agent port (8444). Agent installs, downloads and the install one-liner now use 8444, which answers nothing but agent traffic, so the web console port (8443) can be firewalled to administrators. Installed agents keep working through the upgrade. 8443 and 8444 now have separate certificates, and the 8444 certificate follows the appliance's addresses, including a DHCP address change.
• Permissions are checked inside the server for each action, so the web console, REST API and PowerShell module enforce the same rules.
• Open web console sessions re-check the user every minute: a user who is disabled, deleted or given another role loses the old rights within a minute.
• The agent gateway limits connections per IP address and drops connections that never send data.
• Syslog audit output escapes line breaks, so a crafted value cannot forge an audit line.

CVE report summary#

Every release is scanned for known vulnerabilities (CVEs) in everything it ships, including the third-party operating system and libraries underneath Athena. Scanned 2026/11/05 with grype v0.119.0 (database built 2026/11/04), after removing findings proven not reachable on the appliance. Full report: SBOM download.

Changes#

New

• Experience Score. Resource Metrics on each agent now shows six experience boxes: Memory Pressure, CPU Saturation, Disk per Drive, App Crashes & Hangs (24 h), Logon Duration (Windows) and a 0–10 Experience Score with a 7-day trend and one chip per input. Admins tune the weights and bounds in Settings → Monitoring → Experience score, and monitors can alert on the new values. Part of the core product, no licence module needed.
• Upload whole folders into deployment packages. The package editor has Upload files and Upload folder buttons plus drag and drop, with per-file progress; a folder keeps its subfolders. The 500 MB and 10-file limits are gone; uploads are refused only when the server would drop below its minimum free disk space (Settings → Scheduler → Execution, default 10 GB).
• Agent update failures show why, in the rollout waves and the update history.
• Windows activation status in the agent inventory.
• The RustDesk Windows client ships as a ready-made deployment package.
• Installers check Smart App Control before they start and explain what to do when it would block the agent.
• PowerShell module 2.19.0: Add-AthenaDeploymentPackageFile (files or a whole folder) and Stop-AthenaDeploymentPackageDeployment (cancel a running package deployment).

Changed

• Built-in roles: Operator can now do everything except change the Athena system settings, including managing and running packages; Helpdesk can manage saved reports.
• New tag names may use English letters, digits and - _ | only, up to 64 characters. Existing tags keep working.
• The agent's inventory scan and performance sampling use less CPU on Windows.

Fixed

• A command the agent never received fails in about 30 seconds instead of waiting out its full timeout, and a result that arrives late replaces the failure.
• In a staged rollout, an agent that goes offline mid-update is shown as unreachable, not failed.
• Live metrics keep updating after an agent reconnects or the server restarts, and the console no longer shows “live updates paused” on a working connection.
• Agents are shown offline after a server restart until they reconnect.
• The Windows agent removes old self-update backups after a successful update.
• PowerShell: file uploads stream from disk (a file over 2 GB used to fail), Set-AthenaSettings accepts the object Get-AthenaSettings returns, and Invoke-AthenaCommand now runs the command it creates.

Documentation#

• Installation and the Beginner Guide (with videos)
• Security and hardening and how updates work
• Previous release: 0.9.3