Pricing

FREE TRIAL

Select Language

Security Advisories & Updates

Affected versions, fixes and upgrade guidance for Tier0 Enterprise and Cloud.

Report a vulnerability

How updates shipCloud is updated by the platform. For Enterprise, check the versions in each advisory and upgrade.

Advisories

14 records

Showing 1–10 of 14

September 2026

3 advisories

Sep 20Enterprise

Tool security fixPost-installation endpoint change tool

Tier0 Enterprise endpoint change tool validation and update scope fix

Improves endpoint input validation and domain matching escapes to reduce unintended update scope and incorrect success reports. Failed availability checks now return a partial-success status.

Affected: Enterprise 2.2.6
Fixed in: Enterprise 2.2.7
Upgrade: Images and deployment package

Fixed

Affected: The issue was reproduced with the endpoint change script in an Enterprise 2.2.6 test environment. Impact on other product versions has not been confirmed.
Fixed in: The official Enterprise 2.2.7 version tag is confirmed to include the script fix. This version identifies the Tier0 product and its supporting deployment files.
Upgrade · Images and deployment package: Online installations: use the official upgrade process for the target product version to update application images and supporting deployment files.
Offline installations: use the matching upgrade package containing the fixed script and required images.
This fix affects the endpoint change script in the installation directory, which must be updated with the deployment package. Replacing the application image alone does not update the script.
Post-update verification: Check the deployment package version and endpoint change script. Verify endpoint reachability and confirm that failures return the correct status.

Scope: The post-installation endpoint change script in self-hosted Tier0 Enterprise deployments, used by administrators when changing the endpoint domain or IP address.
Impact: With certain inputs, the earlier script could match more domains than intended or report success despite a failed reachability check. This record concerns administrative tool behavior.
Remediation: Adds domain and IPv4 validation and literal escaping for SQL LIKE patterns; standardizes exit status for failed availability checks and corrects dry-run and proxy handling.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the endpoint change tool fix.
Remediation & verification evidence: The script in the 2.2.7 version tag has been reviewed. Input validation, matching escapes and availability-check status handling are confirmed to remain in place.The fix record reports 9 passing regression checks and targeted update verification on PostgreSQL 17.

Sep 20Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for YAML merge resource consumption

Updates js-yaml to 4.3.2, incorporating upstream security fixes for YAML merge sequences and empty mapping counts to further limit CPU consumption from crafted input.

Affected: js-yaml 4.3.1 (component)
Fixed in: Enterprise 2.2.7
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.1, confirmed in Enterprise 2.2.5. The full product version range has not been enumerated. Actual impact depends on the paths used to parse untrusted YAML.
Fixed in: Enterprise 2.2.7 is confirmed to include js-yaml 4.3.2. The product version is 2.2.7; the fixed component version is 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to pull and deploy a versioned application image containing this fix.
Offline installations: use the upgrade package containing the fixed image to import images and upgrade services.
This update is delivered in the application image that serves the Web frontend. The component is updated with the image.
Post-update verification: Check the running product version, image version and dependency inventory. Enterprise 2.2.7 is confirmed to use js-yaml 4.3.2 for this advisory.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.1.
Impact: The upstream issue concerns resource consumption during YAML merge processing. Actual impact depends on whether the application parses untrusted YAML through the relevant code paths.
Remediation: Updates to js-yaml 4.3.2, adopting upstream merge sequence length limits and counting empty mappings toward the total merge-key limit.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the js-yaml 4.3.2 security update.
Remediation & verification evidence: The official 2.2.7 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.2.The upstream 4.3.2 changelog lists this change under Security.js-yaml 4.3.2 upstream security update

Sep 7Cloud

Security hardeningWeb application responses

Tier0 Cloud HTTP response headers and framework disclosure hardening

Adds security headers to Web application responses and disables the default framework identification header, following the ZAP scan remediation record. The security update has been released.

Affected: Before 2026-09-07
Fixed in: Cloud 2026-09-07
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-09-07 update that use the earlier Web application response configuration. Scope is limited to responses handled by that configuration.
Fixed in: The Cloud update released on 2026-09-07 includes the listed security headers and disables the default framework identification header.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-09-07 hardening and checks the effective response configuration.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: After deployment, inspect headers and framework identifiers on homepage and API responses, checking application and edge responses separately. Existing records confirm local response checks and static checks.

Scope: Tier0 Cloud Web application response configuration. Whether a request uses this configuration depends on deployment and routing. This does not cover every CDN or edge error response.
Impact: Improves the browser response security baseline and reduces default framework disclosure. This record does not mean that all alerts in the scan report have been closed.
Remediation: Retains HSTS, X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin, and disables the X-Powered-By framework header.
Timeline: The related ZAP scan was completed on 2026-08-22. The security update was released on 2026-09-07.
Remediation & verification evidence: Based on frontend fix PR #1851 and its release record. The listed security headers and framework identification settings have been reviewed.The fix record reports type and static checks, plus local header checks for the homepage and API 404 responses.

August 2026

5 advisories

Aug 26Enterprise

Product security fixApp import and replacement

Tier0 Enterprise App import ownership and archive validation

Checks project ownership of uploaded files during App import and replacement and applies consistent archive path, file type and size validation, reducing cross-project file references and malicious archive processing risks.

Affected: Earlier App import implementation
Fixed in: Enterprise 2.2.5
Upgrade: Application image and upgrade package

Fixed

Affected: Historical defect records confirm validation gaps in App import and replacement. The full affected product version range has not been traced; not all earlier versions are classified as affected.
Fixed in: Import and replacement entry points, file ownership checks and archive validation in Enterprise 2.2.5 have been reviewed and confirmed to include the fix. This is a verified fixed release, not a claim about the first fixed release.
Upgrade · Application image and upgrade package: Use the official product upgrade process to install a compatible release containing this fix. Enterprise 2.2.5 has been verified for this advisory.
Online installations update versioned application images. Offline installations use the matching upgrade package to import images and update supporting files.
If older uploaded files lack the correct project association, upload them again in the target project before importing or replacing the App.
Post-update verification: Check product and image versions. Confirm that valid packages can be imported, cross-project file references are rejected, and unsafe paths and oversized packages are blocked before import.

Scope: Tier0 Enterprise App package import, replacement and related file handling. A user with the relevant operation permissions must submit an application package.
Impact: Some earlier import paths lacked ownership checks or consistent package validation and could accept files belonging to another project or packages that did not meet security constraints.
Remediation: Validates the file’s project association before reading the package; rejects unsafe paths, non-regular file types and oversized packages; adds media content and size validation.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 and is confirmed to include this fix.
Remediation & verification evidence: Based on the App import defect fix record (PR #406) and source review of the official 2.2.5 release.The fix record reports passing Go builds and unit tests, including archive security, media validation and file ownership regressions. It does not claim full Docker end-to-end acceptance testing.

Aug 26Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for ordered mapping duplicate key detection

Updates js-yaml from 4.3.0 to 4.3.1, incorporating the upstream security fix for ordered mapping duplicate key detection to reduce excessive computation from crafted YAML input.

Affected: js-yaml 4.3.0 (component)
Fixed in: Enterprise 2.2.5
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.0, confirmed in Enterprise 2.0.0. The full product version range has not been enumerated. Actual impact depends on the relevant YAML parsing paths.
Fixed in: Enterprise 2.2.5 is confirmed to include js-yaml 4.3.1. The later verified Enterprise 2.2.7 release includes js-yaml 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to install a compatible release and application image containing this fix.
Offline installations: use the matching product upgrade package to import the fixed image and upgrade services.
Enterprise 2.2.5 is confirmed to include the fix. Choose the actual upgrade target based on the currently deployed version.
Post-update verification: Check the upgraded running image and dependency inventory. Enterprise 2.2.5 uses js-yaml 4.3.1; the verified 2.2.7 release uses 4.3.2.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.0.
Impact: The upstream issue concerns quadratic complexity in duplicate key detection for ordered mappings (!!omap). Actual impact depends on the relevant YAML parsing paths.
Remediation: Adopts the security fix in js-yaml 4.3.1 and updates and locks the dependency version.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 with the js-yaml 4.3.1 security update.
Remediation & verification evidence: The official 2.2.5 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.1.The upstream 4.3.1 changelog lists the duplicate key detection complexity fix under Security.js-yaml 4.3.1 upstream security update

Aug 25Enterprise

Product security fixFlow gateway access control

Tier0 Enterprise Flow gateway admin endpoint access restriction

Restricts access to Node-RED admin endpoints through the Flow proxy while preserving user-configured HTTP In endpoints, reducing unintended access to management functions.

Affected: Earlier Flow gateway implementation
Fixed in: Enterprise 2.2.4
Upgrade: Application image upgrade

Fixed

Affected: Deployments using the earlier Flow gateway proxy without admin-path restrictions. The full range of affected product releases has not been enumerated.
Fixed in: Enterprise 2.2.4 is confirmed to include this fix. The same admin-path protections remain in 2.2.5 and 2.2.7.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, import images and upgrade services using the matching upgrade package.
Post-update verification: Confirm that restricted admin paths and variants, including case variations, are denied while normal HTTP In endpoints remain available. The historical record includes targeted gateway regression tests.

Scope: Source Flow and Event Flow gateway proxy paths in Tier0 Enterprise.
Impact: The earlier proxy implementation did not separately restrict certain fixed admin paths, potentially broadening access to Node-RED admin endpoints.
Remediation: Adds denial rules for fixed flow management, node management and runtime settings paths. User HTTP In paths remain subject to the product’s normal access rules.
Timeline: Enterprise 2.2.4 was released on 2026-08-25 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #475 and admin-path detection, access blocking and regression tests in the 2.2.4 release.The record confirms successful compilation and gateway tests covering case variations, empty paths and allowed proxy paths. Later verified releases retain the admin-path restrictions.

Aug 25Cloud

Product security fixWeb · Form error reporting

Tier0 Cloud sensitive data redaction in form error reports

Fixes form validation errors that could include field values in error reports by redacting the full form data block, including cases where error text has been truncated.

Affected: Before 2026-08-25
Fixed in: Cloud 2026-08-25
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-08-25 update that use the earlier form error details and monitoring report implementation. Scope is limited to the functionality described here.
Fixed in: The Cloud update released on 2026-08-25 includes this fix, redacting form data as a whole in validation error reports.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-08-25 fix.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: Trigger form validation errors in the target environment and confirm sensitive form values do not appear in reported details, including truncated-text cases. Existing records confirm test-environment checks and automated regression coverage.

Scope: Tier0 Cloud Web error detail processing, browser monitoring reports, and validation error handling in authentication and business forms.
Impact: Validation errors may contain complete form values. Field-by-field filtering may miss sensitive content. This advisory covers the reporting code fix and does not confirm completion of all historical data remediation.
Remediation: Redacts the entire form values block in error text, handles edge cases such as truncated objects and numeric values, and adds validation error handling at 23 locations.
Timeline: Released on 2026-08-25. Form validation scenarios and related automated regressions have been verified.
Remediation & verification evidence: Based on frontend fix PR #1752 and the corresponding release record. The fix code and regression cases have been reviewed.The fix record reports 281 passing related tests. Triggering registration form validation three times in the test environment produced no uncaught exceptions. This does not establish that historical production data has been cleaned up.

Aug 21Cloud

Product security fixCross-origin access configuration

Tier0 Cloud CORS preflight configuration fix

Corrects the relevant cross-origin access configuration. The security scan remediation report records the fix as deployed and confirms that preflight responses for an external origin did not include a cross-origin access permission header.

Affected: N/A · Configuration fix
Fixed in: Configuration update 2026-08-21
Upgrade: Managed Cloud configuration update

Fixed

Affected: This item concerns cross-origin configuration in the production environment tested by the report. Applicability is determined by response behavior before and after the configuration change, not by product or image version.
Fixed in: The report records the configuration update as deployed on 2026-08-21, with passing CORS preflight response verification.
Upgrade · Managed Cloud configuration update: The platform maintains the relevant cross-origin response configuration for hosted services. Customers do not need a separate patch package.
Custom domains, gateways and edge response configuration require separate verification. Replacing an application image alone does not establish that this configuration is active.
Post-update verification: Check preflight responses using an untrusted external Origin and confirm normal access from legitimate origins. The historical verification applies only to the configuration tested in the report.

Scope: Production CORS preflight responses reviewed in the ZAP scan remediation report dated 2026-08-22. The findings apply only to the targets and configuration tested in that report.
Impact: Overly permissive CORS settings can broaden browser access to cross-origin responses. The report groups 23 related scan alerts under resolved items; these are not 23 independent vulnerabilities.
Remediation: Adjusts the cross-origin response policy. The report’s verification found no Access-Control-Allow-Origin header for an external-origin preflight request, with only Vary: Origin returned.
Timeline: The report records the fix as deployed on 2026-08-21. The scan remediation summary dated 2026-08-22 documents external-origin preflight verification.
Remediation & verification evidence: Based on the resolved finding and measured response-header summary in section 3.2 of the Tier0 Production ZAP Security Scan Remediation Summary (2026-08-22).This item is documented from the scan report. No corresponding standalone GitHub change or image version was found; it does not establish continuous verification across all domains.

July 2026

4 advisories

Jul 16Enterprise

Security hardeningInternal services and admin access

Tier0 Enterprise internal service authentication and admin port hardening

Strengthens authentication for internal Node-RED and Marimo services and restricts EMQX admin access, reducing direct exposure of internal services and management functions.

Affected: Earlier service configuration
Fixed in: Enterprise 2.0.0
Upgrade: Images and deployment configuration

Fixed

Affected: Deployments using the earlier internal service authentication and admin port configuration. The full range of affected product releases has not been confirmed; check the deployed configuration.
Fixed in: Enterprise 2.0.0 is confirmed to include this update. The protections are also present in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Images and deployment configuration: Use the official upgrade process to update application and related service images, together with deployment configuration.
Confirm that internal service authentication is enabled and the EMQX admin port is not exposed on the host.
For existing installations, maintain admin passwords under the current credential management process. This update does not automatically rotate historical passwords.
Post-update verification: Confirm that the platform can access internal services, unauthorized direct connections are rejected, and admin port mappings are restricted. The historical record confirms passing smoke checks on an actual fresh installation.

Scope: Internal Node-RED and Marimo service connections and EMQX admin access in Tier0 Enterprise, including gateway and deployment configuration.
Impact: Missing authentication on internal services or admin ports exposed on the host can broaden access to management functions.
Remediation: Internal services validate runtime tokens supplied by the platform gateway. EMQX admin port mappings on the host and the in-product admin entry point have been removed.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this security update.
Remediation & verification evidence: Based on Enterprise PR #157, the 2.0.0 release, and gateway and service deployment configuration.The record confirms passing Go tests, compilation and smoke checks on an actual fresh installation, covering internal service token checks and restricted EMQX admin port exposure.

Jul 16Enterprise

Product security fixApplication deployment error logs

Tier0 Enterprise sensitive data redaction in deployment errors

Redacts database connection details, application API keys and other sensitive values before failed deployment logs are included in error messages, reducing the risk of credential exposure.

Affected: Earlier deployment log handling
Fixed in: Enterprise 2.0.0
Upgrade: Application image upgrade

Fixed

Affected: Versions using the earlier failed-deployment log handling. The full range of affected product releases has not been confirmed. Scope is limited to the error-message path described here.
Fixed in: Enterprise 2.0.0 is confirmed to include deployment log redaction. The redaction call and regression tests remain in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, use the matching product upgrade package to import images and update services.
Post-update verification: Use test credentials in a failed-deployment log to confirm sensitive values are redacted while useful diagnostic information remains. The historical record confirms passing targeted regression tests.

Scope: The Tier0 Enterprise error-handling path that includes container logs in error messages when dynamic application deployment fails.
Impact: If application logs contain connection strings or credentials, unfiltered deployment errors may expose them. Actual impact depends on the application log content.
Remediation: Deployment logs are filtered before error output, covering sensitive values in database connection strings, environment variables and JSON logs.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #181, deployment error handling in the 2.0.0 release, and direct regression tests.The record confirms a successful backend build and targeted project-domain tests. Redaction tests cover connection strings, environment variables and JSON logs. Verification does not extend to all log channels or historical data cleanup.

Reading versions & upgrades

Enterprise uses product versions. Cloud uses update release dates.

Affected

Enterprise lists verified product or component versions. Cloud lists relevant versions before the security update. Scope is limited to the features and usage scenarios described in each advisory.

Fixed in

Cloud YYYY-MM-DD identifies the update release date. Dates use Beijing time (UTC+8). Enterprise uses official product version numbers.

Images & upgrade packages

Cloud updates are managed by the platform; hosted customers do not install patches themselves. Enterprise uses online image upgrades or matching offline packages. Update deployment files when scripts or configuration are included.

Remediation & evidence

Each advisory provides remediation, release and verification evidence, with the actual test scope. Configuration fixes use deployment dates; environment verification records show their completion dates.

Security Advisories & Updates

Affected versions, fixes and upgrade guidance for Tier0 Enterprise and Cloud.

Report a vulnerability

How updates shipCloud is updated by the platform. For Enterprise, check the versions in each advisory and upgrade.

Advisories

14 records

Showing 1–10 of 14

September 2026

3 advisories

Sep 20Enterprise

Tool security fixPost-installation endpoint change tool

Tier0 Enterprise endpoint change tool validation and update scope fix

Improves endpoint input validation and domain matching escapes to reduce unintended update scope and incorrect success reports. Failed availability checks now return a partial-success status.

Affected: Enterprise 2.2.6
Fixed in: Enterprise 2.2.7
Upgrade: Images and deployment package

Fixed

Affected: The issue was reproduced with the endpoint change script in an Enterprise 2.2.6 test environment. Impact on other product versions has not been confirmed.
Fixed in: The official Enterprise 2.2.7 version tag is confirmed to include the script fix. This version identifies the Tier0 product and its supporting deployment files.
Upgrade · Images and deployment package: Online installations: use the official upgrade process for the target product version to update application images and supporting deployment files.
Offline installations: use the matching upgrade package containing the fixed script and required images.
This fix affects the endpoint change script in the installation directory, which must be updated with the deployment package. Replacing the application image alone does not update the script.
Post-update verification: Check the deployment package version and endpoint change script. Verify endpoint reachability and confirm that failures return the correct status.

Scope: The post-installation endpoint change script in self-hosted Tier0 Enterprise deployments, used by administrators when changing the endpoint domain or IP address.
Impact: With certain inputs, the earlier script could match more domains than intended or report success despite a failed reachability check. This record concerns administrative tool behavior.
Remediation: Adds domain and IPv4 validation and literal escaping for SQL LIKE patterns; standardizes exit status for failed availability checks and corrects dry-run and proxy handling.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the endpoint change tool fix.
Remediation & verification evidence: The script in the 2.2.7 version tag has been reviewed. Input validation, matching escapes and availability-check status handling are confirmed to remain in place.The fix record reports 9 passing regression checks and targeted update verification on PostgreSQL 17.

Sep 20Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for YAML merge resource consumption

Updates js-yaml to 4.3.2, incorporating upstream security fixes for YAML merge sequences and empty mapping counts to further limit CPU consumption from crafted input.

Affected: js-yaml 4.3.1 (component)
Fixed in: Enterprise 2.2.7
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.1, confirmed in Enterprise 2.2.5. The full product version range has not been enumerated. Actual impact depends on the paths used to parse untrusted YAML.
Fixed in: Enterprise 2.2.7 is confirmed to include js-yaml 4.3.2. The product version is 2.2.7; the fixed component version is 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to pull and deploy a versioned application image containing this fix.
Offline installations: use the upgrade package containing the fixed image to import images and upgrade services.
This update is delivered in the application image that serves the Web frontend. The component is updated with the image.
Post-update verification: Check the running product version, image version and dependency inventory. Enterprise 2.2.7 is confirmed to use js-yaml 4.3.2 for this advisory.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.1.
Impact: The upstream issue concerns resource consumption during YAML merge processing. Actual impact depends on whether the application parses untrusted YAML through the relevant code paths.
Remediation: Updates to js-yaml 4.3.2, adopting upstream merge sequence length limits and counting empty mappings toward the total merge-key limit.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the js-yaml 4.3.2 security update.
Remediation & verification evidence: The official 2.2.7 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.2.The upstream 4.3.2 changelog lists this change under Security.js-yaml 4.3.2 upstream security update

Sep 7Cloud

Security hardeningWeb application responses

Tier0 Cloud HTTP response headers and framework disclosure hardening

Adds security headers to Web application responses and disables the default framework identification header, following the ZAP scan remediation record. The security update has been released.

Affected: Before 2026-09-07
Fixed in: Cloud 2026-09-07
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-09-07 update that use the earlier Web application response configuration. Scope is limited to responses handled by that configuration.
Fixed in: The Cloud update released on 2026-09-07 includes the listed security headers and disables the default framework identification header.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-09-07 hardening and checks the effective response configuration.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: After deployment, inspect headers and framework identifiers on homepage and API responses, checking application and edge responses separately. Existing records confirm local response checks and static checks.

Scope: Tier0 Cloud Web application response configuration. Whether a request uses this configuration depends on deployment and routing. This does not cover every CDN or edge error response.
Impact: Improves the browser response security baseline and reduces default framework disclosure. This record does not mean that all alerts in the scan report have been closed.
Remediation: Retains HSTS, X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin, and disables the X-Powered-By framework header.
Timeline: The related ZAP scan was completed on 2026-08-22. The security update was released on 2026-09-07.
Remediation & verification evidence: Based on frontend fix PR #1851 and its release record. The listed security headers and framework identification settings have been reviewed.The fix record reports type and static checks, plus local header checks for the homepage and API 404 responses.

August 2026

5 advisories

Aug 26Enterprise

Product security fixApp import and replacement

Tier0 Enterprise App import ownership and archive validation

Affected: Earlier App import implementation
Fixed in: Enterprise 2.2.5
Upgrade: Application image and upgrade package

Fixed

Affected: Historical defect records confirm validation gaps in App import and replacement. The full affected product version range has not been traced; not all earlier versions are classified as affected.
Fixed in: Import and replacement entry points, file ownership checks and archive validation in Enterprise 2.2.5 have been reviewed and confirmed to include the fix. This is a verified fixed release, not a claim about the first fixed release.
Upgrade · Application image and upgrade package: Use the official product upgrade process to install a compatible release containing this fix. Enterprise 2.2.5 has been verified for this advisory.
Online installations update versioned application images. Offline installations use the matching upgrade package to import images and update supporting files.
If older uploaded files lack the correct project association, upload them again in the target project before importing or replacing the App.
Post-update verification: Check product and image versions. Confirm that valid packages can be imported, cross-project file references are rejected, and unsafe paths and oversized packages are blocked before import.

Scope: Tier0 Enterprise App package import, replacement and related file handling. A user with the relevant operation permissions must submit an application package.
Impact: Some earlier import paths lacked ownership checks or consistent package validation and could accept files belonging to another project or packages that did not meet security constraints.
Remediation: Validates the file’s project association before reading the package; rejects unsafe paths, non-regular file types and oversized packages; adds media content and size validation.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 and is confirmed to include this fix.
Remediation & verification evidence: Based on the App import defect fix record (PR #406) and source review of the official 2.2.5 release.The fix record reports passing Go builds and unit tests, including archive security, media validation and file ownership regressions. It does not claim full Docker end-to-end acceptance testing.

Aug 26Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for ordered mapping duplicate key detection

Updates js-yaml from 4.3.0 to 4.3.1, incorporating the upstream security fix for ordered mapping duplicate key detection to reduce excessive computation from crafted YAML input.

Affected: js-yaml 4.3.0 (component)
Fixed in: Enterprise 2.2.5
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.0, confirmed in Enterprise 2.0.0. The full product version range has not been enumerated. Actual impact depends on the relevant YAML parsing paths.
Fixed in: Enterprise 2.2.5 is confirmed to include js-yaml 4.3.1. The later verified Enterprise 2.2.7 release includes js-yaml 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to install a compatible release and application image containing this fix.
Offline installations: use the matching product upgrade package to import the fixed image and upgrade services.
Enterprise 2.2.5 is confirmed to include the fix. Choose the actual upgrade target based on the currently deployed version.
Post-update verification: Check the upgraded running image and dependency inventory. Enterprise 2.2.5 uses js-yaml 4.3.1; the verified 2.2.7 release uses 4.3.2.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.0.
Impact: The upstream issue concerns quadratic complexity in duplicate key detection for ordered mappings (!!omap). Actual impact depends on the relevant YAML parsing paths.
Remediation: Adopts the security fix in js-yaml 4.3.1 and updates and locks the dependency version.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 with the js-yaml 4.3.1 security update.
Remediation & verification evidence: The official 2.2.5 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.1.The upstream 4.3.1 changelog lists the duplicate key detection complexity fix under Security.js-yaml 4.3.1 upstream security update

Aug 25Enterprise

Product security fixFlow gateway access control

Tier0 Enterprise Flow gateway admin endpoint access restriction

Restricts access to Node-RED admin endpoints through the Flow proxy while preserving user-configured HTTP In endpoints, reducing unintended access to management functions.

Affected: Earlier Flow gateway implementation
Fixed in: Enterprise 2.2.4
Upgrade: Application image upgrade

Fixed

Affected: Deployments using the earlier Flow gateway proxy without admin-path restrictions. The full range of affected product releases has not been enumerated.
Fixed in: Enterprise 2.2.4 is confirmed to include this fix. The same admin-path protections remain in 2.2.5 and 2.2.7.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, import images and upgrade services using the matching upgrade package.
Post-update verification: Confirm that restricted admin paths and variants, including case variations, are denied while normal HTTP In endpoints remain available. The historical record includes targeted gateway regression tests.

Scope: Source Flow and Event Flow gateway proxy paths in Tier0 Enterprise.
Impact: The earlier proxy implementation did not separately restrict certain fixed admin paths, potentially broadening access to Node-RED admin endpoints.
Remediation: Adds denial rules for fixed flow management, node management and runtime settings paths. User HTTP In paths remain subject to the product’s normal access rules.
Timeline: Enterprise 2.2.4 was released on 2026-08-25 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #475 and admin-path detection, access blocking and regression tests in the 2.2.4 release.The record confirms successful compilation and gateway tests covering case variations, empty paths and allowed proxy paths. Later verified releases retain the admin-path restrictions.

Aug 25Cloud

Product security fixWeb · Form error reporting

Tier0 Cloud sensitive data redaction in form error reports

Fixes form validation errors that could include field values in error reports by redacting the full form data block, including cases where error text has been truncated.

Affected: Before 2026-08-25
Fixed in: Cloud 2026-08-25
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-08-25 update that use the earlier form error details and monitoring report implementation. Scope is limited to the functionality described here.
Fixed in: The Cloud update released on 2026-08-25 includes this fix, redacting form data as a whole in validation error reports.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-08-25 fix.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: Trigger form validation errors in the target environment and confirm sensitive form values do not appear in reported details, including truncated-text cases. Existing records confirm test-environment checks and automated regression coverage.

Scope: Tier0 Cloud Web error detail processing, browser monitoring reports, and validation error handling in authentication and business forms.
Impact: Validation errors may contain complete form values. Field-by-field filtering may miss sensitive content. This advisory covers the reporting code fix and does not confirm completion of all historical data remediation.
Remediation: Redacts the entire form values block in error text, handles edge cases such as truncated objects and numeric values, and adds validation error handling at 23 locations.
Timeline: Released on 2026-08-25. Form validation scenarios and related automated regressions have been verified.
Remediation & verification evidence: Based on frontend fix PR #1752 and the corresponding release record. The fix code and regression cases have been reviewed.The fix record reports 281 passing related tests. Triggering registration form validation three times in the test environment produced no uncaught exceptions. This does not establish that historical production data has been cleaned up.

Aug 21Cloud

Product security fixCross-origin access configuration

Tier0 Cloud CORS preflight configuration fix

Affected: N/A · Configuration fix
Fixed in: Configuration update 2026-08-21
Upgrade: Managed Cloud configuration update

Fixed

Affected: This item concerns cross-origin configuration in the production environment tested by the report. Applicability is determined by response behavior before and after the configuration change, not by product or image version.
Fixed in: The report records the configuration update as deployed on 2026-08-21, with passing CORS preflight response verification.
Upgrade · Managed Cloud configuration update: The platform maintains the relevant cross-origin response configuration for hosted services. Customers do not need a separate patch package.
Custom domains, gateways and edge response configuration require separate verification. Replacing an application image alone does not establish that this configuration is active.
Post-update verification: Check preflight responses using an untrusted external Origin and confirm normal access from legitimate origins. The historical verification applies only to the configuration tested in the report.

Scope: Production CORS preflight responses reviewed in the ZAP scan remediation report dated 2026-08-22. The findings apply only to the targets and configuration tested in that report.
Impact: Overly permissive CORS settings can broaden browser access to cross-origin responses. The report groups 23 related scan alerts under resolved items; these are not 23 independent vulnerabilities.
Remediation: Adjusts the cross-origin response policy. The report’s verification found no Access-Control-Allow-Origin header for an external-origin preflight request, with only Vary: Origin returned.
Timeline: The report records the fix as deployed on 2026-08-21. The scan remediation summary dated 2026-08-22 documents external-origin preflight verification.
Remediation & verification evidence: Based on the resolved finding and measured response-header summary in section 3.2 of the Tier0 Production ZAP Security Scan Remediation Summary (2026-08-22).This item is documented from the scan report. No corresponding standalone GitHub change or image version was found; it does not establish continuous verification across all domains.

July 2026

4 advisories

Jul 16Enterprise

Security hardeningInternal services and admin access

Tier0 Enterprise internal service authentication and admin port hardening

Strengthens authentication for internal Node-RED and Marimo services and restricts EMQX admin access, reducing direct exposure of internal services and management functions.

Affected: Earlier service configuration
Fixed in: Enterprise 2.0.0
Upgrade: Images and deployment configuration

Fixed

Affected: Deployments using the earlier internal service authentication and admin port configuration. The full range of affected product releases has not been confirmed; check the deployed configuration.
Fixed in: Enterprise 2.0.0 is confirmed to include this update. The protections are also present in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Images and deployment configuration: Use the official upgrade process to update application and related service images, together with deployment configuration.
Confirm that internal service authentication is enabled and the EMQX admin port is not exposed on the host.
For existing installations, maintain admin passwords under the current credential management process. This update does not automatically rotate historical passwords.
Post-update verification: Confirm that the platform can access internal services, unauthorized direct connections are rejected, and admin port mappings are restricted. The historical record confirms passing smoke checks on an actual fresh installation.

Scope: Internal Node-RED and Marimo service connections and EMQX admin access in Tier0 Enterprise, including gateway and deployment configuration.
Impact: Missing authentication on internal services or admin ports exposed on the host can broaden access to management functions.
Remediation: Internal services validate runtime tokens supplied by the platform gateway. EMQX admin port mappings on the host and the in-product admin entry point have been removed.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this security update.
Remediation & verification evidence: Based on Enterprise PR #157, the 2.0.0 release, and gateway and service deployment configuration.The record confirms passing Go tests, compilation and smoke checks on an actual fresh installation, covering internal service token checks and restricted EMQX admin port exposure.

Jul 16Enterprise

Product security fixApplication deployment error logs

Tier0 Enterprise sensitive data redaction in deployment errors

Redacts database connection details, application API keys and other sensitive values before failed deployment logs are included in error messages, reducing the risk of credential exposure.

Affected: Earlier deployment log handling
Fixed in: Enterprise 2.0.0
Upgrade: Application image upgrade

Fixed

Affected: Versions using the earlier failed-deployment log handling. The full range of affected product releases has not been confirmed. Scope is limited to the error-message path described here.
Fixed in: Enterprise 2.0.0 is confirmed to include deployment log redaction. The redaction call and regression tests remain in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, use the matching product upgrade package to import images and update services.
Post-update verification: Use test credentials in a failed-deployment log to confirm sensitive values are redacted while useful diagnostic information remains. The historical record confirms passing targeted regression tests.

Scope: The Tier0 Enterprise error-handling path that includes container logs in error messages when dynamic application deployment fails.
Impact: If application logs contain connection strings or credentials, unfiltered deployment errors may expose them. Actual impact depends on the application log content.
Remediation: Deployment logs are filtered before error output, covering sensitive values in database connection strings, environment variables and JSON logs.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #181, deployment error handling in the 2.0.0 release, and direct regression tests.The record confirms a successful backend build and targeted project-domain tests. Redaction tests cover connection strings, environment variables and JSON logs. Verification does not extend to all log channels or historical data cleanup.

Reading versions & upgrades

Enterprise uses product versions. Cloud uses update release dates.

Affected

Enterprise lists verified product or component versions. Cloud lists relevant versions before the security update. Scope is limited to the features and usage scenarios described in each advisory.

Fixed in

Cloud YYYY-MM-DD identifies the update release date. Dates use Beijing time (UTC+8). Enterprise uses official product version numbers.

Images & upgrade packages

Remediation & evidence

Security Advisories & Updates

Affected versions, fixes and upgrade guidance for Tier0 Enterprise and Cloud.

Report a vulnerability

How updates shipCloud is updated by the platform. For Enterprise, check the versions in each advisory and upgrade.

Advisories

14 records

Showing 1–10 of 14

September 2026

3 advisories

Sep 20Enterprise

Tool security fixPost-installation endpoint change tool

Tier0 Enterprise endpoint change tool validation and update scope fix

Improves endpoint input validation and domain matching escapes to reduce unintended update scope and incorrect success reports. Failed availability checks now return a partial-success status.

Affected: Enterprise 2.2.6
Fixed in: Enterprise 2.2.7
Upgrade: Images and deployment package

Fixed

Affected: The issue was reproduced with the endpoint change script in an Enterprise 2.2.6 test environment. Impact on other product versions has not been confirmed.
Fixed in: The official Enterprise 2.2.7 version tag is confirmed to include the script fix. This version identifies the Tier0 product and its supporting deployment files.
Upgrade · Images and deployment package: Online installations: use the official upgrade process for the target product version to update application images and supporting deployment files.
Offline installations: use the matching upgrade package containing the fixed script and required images.
This fix affects the endpoint change script in the installation directory, which must be updated with the deployment package. Replacing the application image alone does not update the script.
Post-update verification: Check the deployment package version and endpoint change script. Verify endpoint reachability and confirm that failures return the correct status.

Scope: The post-installation endpoint change script in self-hosted Tier0 Enterprise deployments, used by administrators when changing the endpoint domain or IP address.
Impact: With certain inputs, the earlier script could match more domains than intended or report success despite a failed reachability check. This record concerns administrative tool behavior.
Remediation: Adds domain and IPv4 validation and literal escaping for SQL LIKE patterns; standardizes exit status for failed availability checks and corrects dry-run and proxy handling.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the endpoint change tool fix.
Remediation & verification evidence: The script in the 2.2.7 version tag has been reviewed. Input validation, matching escapes and availability-check status handling are confirmed to remain in place.The fix record reports 9 passing regression checks and targeted update verification on PostgreSQL 17.

Sep 20Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for YAML merge resource consumption

Updates js-yaml to 4.3.2, incorporating upstream security fixes for YAML merge sequences and empty mapping counts to further limit CPU consumption from crafted input.

Affected: js-yaml 4.3.1 (component)
Fixed in: Enterprise 2.2.7
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.1, confirmed in Enterprise 2.2.5. The full product version range has not been enumerated. Actual impact depends on the paths used to parse untrusted YAML.
Fixed in: Enterprise 2.2.7 is confirmed to include js-yaml 4.3.2. The product version is 2.2.7; the fixed component version is 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to pull and deploy a versioned application image containing this fix.
Offline installations: use the upgrade package containing the fixed image to import images and upgrade services.
This update is delivered in the application image that serves the Web frontend. The component is updated with the image.
Post-update verification: Check the running product version, image version and dependency inventory. Enterprise 2.2.7 is confirmed to use js-yaml 4.3.2 for this advisory.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.1.
Impact: The upstream issue concerns resource consumption during YAML merge processing. Actual impact depends on whether the application parses untrusted YAML through the relevant code paths.
Remediation: Updates to js-yaml 4.3.2, adopting upstream merge sequence length limits and counting empty mappings toward the total merge-key limit.
Timeline: Enterprise 2.2.7 was released on 2026-09-20 with the js-yaml 4.3.2 security update.
Remediation & verification evidence: The official 2.2.7 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.2.The upstream 4.3.2 changelog lists this change under Security.js-yaml 4.3.2 upstream security update

Sep 7Cloud

Security hardeningWeb application responses

Tier0 Cloud HTTP response headers and framework disclosure hardening

Adds security headers to Web application responses and disables the default framework identification header, following the ZAP scan remediation record. The security update has been released.

Affected: Before 2026-09-07
Fixed in: Cloud 2026-09-07
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-09-07 update that use the earlier Web application response configuration. Scope is limited to responses handled by that configuration.
Fixed in: The Cloud update released on 2026-09-07 includes the listed security headers and disables the default framework identification header.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-09-07 hardening and checks the effective response configuration.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: After deployment, inspect headers and framework identifiers on homepage and API responses, checking application and edge responses separately. Existing records confirm local response checks and static checks.

Scope: Tier0 Cloud Web application response configuration. Whether a request uses this configuration depends on deployment and routing. This does not cover every CDN or edge error response.
Impact: Improves the browser response security baseline and reduces default framework disclosure. This record does not mean that all alerts in the scan report have been closed.
Remediation: Retains HSTS, X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin, and disables the X-Powered-By framework header.
Timeline: The related ZAP scan was completed on 2026-08-22. The security update was released on 2026-09-07.
Remediation & verification evidence: Based on frontend fix PR #1851 and its release record. The listed security headers and framework identification settings have been reviewed.The fix record reports type and static checks, plus local header checks for the homepage and API 404 responses.

August 2026

5 advisories

Aug 26Enterprise

Product security fixApp import and replacement

Tier0 Enterprise App import ownership and archive validation

Affected: Earlier App import implementation
Fixed in: Enterprise 2.2.5
Upgrade: Application image and upgrade package

Fixed

Affected: Historical defect records confirm validation gaps in App import and replacement. The full affected product version range has not been traced; not all earlier versions are classified as affected.
Fixed in: Import and replacement entry points, file ownership checks and archive validation in Enterprise 2.2.5 have been reviewed and confirmed to include the fix. This is a verified fixed release, not a claim about the first fixed release.
Upgrade · Application image and upgrade package: Use the official product upgrade process to install a compatible release containing this fix. Enterprise 2.2.5 has been verified for this advisory.
Online installations update versioned application images. Offline installations use the matching upgrade package to import images and update supporting files.
If older uploaded files lack the correct project association, upload them again in the target project before importing or replacing the App.
Post-update verification: Check product and image versions. Confirm that valid packages can be imported, cross-project file references are rejected, and unsafe paths and oversized packages are blocked before import.

Scope: Tier0 Enterprise App package import, replacement and related file handling. A user with the relevant operation permissions must submit an application package.
Impact: Some earlier import paths lacked ownership checks or consistent package validation and could accept files belonging to another project or packages that did not meet security constraints.
Remediation: Validates the file’s project association before reading the package; rejects unsafe paths, non-regular file types and oversized packages; adds media content and size validation.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 and is confirmed to include this fix.
Remediation & verification evidence: Based on the App import defect fix record (PR #406) and source review of the official 2.2.5 release.The fix record reports passing Go builds and unit tests, including archive security, media validation and file ownership regressions. It does not claim full Docker end-to-end acceptance testing.

Aug 26Enterprise

Dependency security updateWeb · js-yaml

Tier0 Enterprise js-yaml update for ordered mapping duplicate key detection

Updates js-yaml from 4.3.0 to 4.3.1, incorporating the upstream security fix for ordered mapping duplicate key detection to reduce excessive computation from crafted YAML input.

Affected: js-yaml 4.3.0 (component)
Fixed in: Enterprise 2.2.5
Upgrade: Application image upgrade

Fixed

Affected: The component version before this update was js-yaml 4.3.0, confirmed in Enterprise 2.0.0. The full product version range has not been enumerated. Actual impact depends on the relevant YAML parsing paths.
Fixed in: Enterprise 2.2.5 is confirmed to include js-yaml 4.3.1. The later verified Enterprise 2.2.7 release includes js-yaml 4.3.2.
Upgrade · Application image upgrade: Online installations: use the product upgrade process to install a compatible release and application image containing this fix.
Offline installations: use the matching product upgrade package to import the fixed image and upgrade services.
Enterprise 2.2.5 is confirmed to include the fix. Choose the actual upgrade target based on the currently deployed version.
Post-update verification: Check the upgraded running image and dependency inventory. Enterprise 2.2.5 uses js-yaml 4.3.1; the verified 2.2.7 release uses 4.3.2.

Scope: js-yaml in the Tier0 Enterprise Web frontend dependency chain. The component version before this update was 4.3.0.
Impact: The upstream issue concerns quadratic complexity in duplicate key detection for ordered mappings (!!omap). Actual impact depends on the relevant YAML parsing paths.
Remediation: Adopts the security fix in js-yaml 4.3.1 and updates and locks the dependency version.
Timeline: Enterprise 2.2.5 was released on 2026-08-26 with the js-yaml 4.3.1 security update.
Remediation & verification evidence: The official 2.2.5 release and the lockfile at its version tag have been reviewed, confirming dependency version 4.3.1.The upstream 4.3.1 changelog lists the duplicate key detection complexity fix under Security.js-yaml 4.3.1 upstream security update

Aug 25Enterprise

Product security fixFlow gateway access control

Tier0 Enterprise Flow gateway admin endpoint access restriction

Restricts access to Node-RED admin endpoints through the Flow proxy while preserving user-configured HTTP In endpoints, reducing unintended access to management functions.

Affected: Earlier Flow gateway implementation
Fixed in: Enterprise 2.2.4
Upgrade: Application image upgrade

Fixed

Affected: Deployments using the earlier Flow gateway proxy without admin-path restrictions. The full range of affected product releases has not been enumerated.
Fixed in: Enterprise 2.2.4 is confirmed to include this fix. The same admin-path protections remain in 2.2.5 and 2.2.7.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, import images and upgrade services using the matching upgrade package.
Post-update verification: Confirm that restricted admin paths and variants, including case variations, are denied while normal HTTP In endpoints remain available. The historical record includes targeted gateway regression tests.

Scope: Source Flow and Event Flow gateway proxy paths in Tier0 Enterprise.
Impact: The earlier proxy implementation did not separately restrict certain fixed admin paths, potentially broadening access to Node-RED admin endpoints.
Remediation: Adds denial rules for fixed flow management, node management and runtime settings paths. User HTTP In paths remain subject to the product’s normal access rules.
Timeline: Enterprise 2.2.4 was released on 2026-08-25 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #475 and admin-path detection, access blocking and regression tests in the 2.2.4 release.The record confirms successful compilation and gateway tests covering case variations, empty paths and allowed proxy paths. Later verified releases retain the admin-path restrictions.

Aug 25Cloud

Product security fixWeb · Form error reporting

Tier0 Cloud sensitive data redaction in form error reports

Fixes form validation errors that could include field values in error reports by redacting the full form data block, including cases where error text has been truncated.

Affected: Before 2026-08-25
Fixed in: Cloud 2026-08-25
Upgrade: Managed Cloud update

Fixed

Affected: Cloud versions before the 2026-08-25 update that use the earlier form error details and monitoring report implementation. Scope is limited to the functionality described here.
Fixed in: The Cloud update released on 2026-08-25 includes this fix, redacting form data as a whole in validation error reports.
Upgrade · Managed Cloud update: Through the official release process, the platform updates the Web application image to include the Cloud 2026-08-25 fix.
Hosted customers do not need to download a separate patch or replace images themselves.
Post-update verification: Trigger form validation errors in the target environment and confirm sensitive form values do not appear in reported details, including truncated-text cases. Existing records confirm test-environment checks and automated regression coverage.

Scope: Tier0 Cloud Web error detail processing, browser monitoring reports, and validation error handling in authentication and business forms.
Impact: Validation errors may contain complete form values. Field-by-field filtering may miss sensitive content. This advisory covers the reporting code fix and does not confirm completion of all historical data remediation.
Remediation: Redacts the entire form values block in error text, handles edge cases such as truncated objects and numeric values, and adds validation error handling at 23 locations.
Timeline: Released on 2026-08-25. Form validation scenarios and related automated regressions have been verified.
Remediation & verification evidence: Based on frontend fix PR #1752 and the corresponding release record. The fix code and regression cases have been reviewed.The fix record reports 281 passing related tests. Triggering registration form validation three times in the test environment produced no uncaught exceptions. This does not establish that historical production data has been cleaned up.

Aug 21Cloud

Product security fixCross-origin access configuration

Tier0 Cloud CORS preflight configuration fix

Affected: N/A · Configuration fix
Fixed in: Configuration update 2026-08-21
Upgrade: Managed Cloud configuration update

Fixed

Affected: This item concerns cross-origin configuration in the production environment tested by the report. Applicability is determined by response behavior before and after the configuration change, not by product or image version.
Fixed in: The report records the configuration update as deployed on 2026-08-21, with passing CORS preflight response verification.
Upgrade · Managed Cloud configuration update: The platform maintains the relevant cross-origin response configuration for hosted services. Customers do not need a separate patch package.
Custom domains, gateways and edge response configuration require separate verification. Replacing an application image alone does not establish that this configuration is active.
Post-update verification: Check preflight responses using an untrusted external Origin and confirm normal access from legitimate origins. The historical verification applies only to the configuration tested in the report.

Scope: Production CORS preflight responses reviewed in the ZAP scan remediation report dated 2026-08-22. The findings apply only to the targets and configuration tested in that report.
Impact: Overly permissive CORS settings can broaden browser access to cross-origin responses. The report groups 23 related scan alerts under resolved items; these are not 23 independent vulnerabilities.
Remediation: Adjusts the cross-origin response policy. The report’s verification found no Access-Control-Allow-Origin header for an external-origin preflight request, with only Vary: Origin returned.
Timeline: The report records the fix as deployed on 2026-08-21. The scan remediation summary dated 2026-08-22 documents external-origin preflight verification.
Remediation & verification evidence: Based on the resolved finding and measured response-header summary in section 3.2 of the Tier0 Production ZAP Security Scan Remediation Summary (2026-08-22).This item is documented from the scan report. No corresponding standalone GitHub change or image version was found; it does not establish continuous verification across all domains.

July 2026

4 advisories

Jul 16Enterprise

Security hardeningInternal services and admin access

Tier0 Enterprise internal service authentication and admin port hardening

Strengthens authentication for internal Node-RED and Marimo services and restricts EMQX admin access, reducing direct exposure of internal services and management functions.

Affected: Earlier service configuration
Fixed in: Enterprise 2.0.0
Upgrade: Images and deployment configuration

Fixed

Affected: Deployments using the earlier internal service authentication and admin port configuration. The full range of affected product releases has not been confirmed; check the deployed configuration.
Fixed in: Enterprise 2.0.0 is confirmed to include this update. The protections are also present in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Images and deployment configuration: Use the official upgrade process to update application and related service images, together with deployment configuration.
Confirm that internal service authentication is enabled and the EMQX admin port is not exposed on the host.
For existing installations, maintain admin passwords under the current credential management process. This update does not automatically rotate historical passwords.
Post-update verification: Confirm that the platform can access internal services, unauthorized direct connections are rejected, and admin port mappings are restricted. The historical record confirms passing smoke checks on an actual fresh installation.

Scope: Internal Node-RED and Marimo service connections and EMQX admin access in Tier0 Enterprise, including gateway and deployment configuration.
Impact: Missing authentication on internal services or admin ports exposed on the host can broaden access to management functions.
Remediation: Internal services validate runtime tokens supplied by the platform gateway. EMQX admin port mappings on the host and the in-product admin entry point have been removed.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this security update.
Remediation & verification evidence: Based on Enterprise PR #157, the 2.0.0 release, and gateway and service deployment configuration.The record confirms passing Go tests, compilation and smoke checks on an actual fresh installation, covering internal service token checks and restricted EMQX admin port exposure.

Jul 16Enterprise

Product security fixApplication deployment error logs

Tier0 Enterprise sensitive data redaction in deployment errors

Redacts database connection details, application API keys and other sensitive values before failed deployment logs are included in error messages, reducing the risk of credential exposure.

Affected: Earlier deployment log handling
Fixed in: Enterprise 2.0.0
Upgrade: Application image upgrade

Fixed

Affected: Versions using the earlier failed-deployment log handling. The full range of affected product releases has not been confirmed. Scope is limited to the error-message path described here.
Fixed in: Enterprise 2.0.0 is confirmed to include deployment log redaction. The redaction call and regression tests remain in 2.2.5 and 2.2.7. These are verified releases, not a claim about the first fixed release.
Upgrade · Application image upgrade: Use the official upgrade process to install a compatible product release and application image containing this fix.
For offline installations, use the matching product upgrade package to import images and update services.
Post-update verification: Use test credentials in a failed-deployment log to confirm sensitive values are redacted while useful diagnostic information remains. The historical record confirms passing targeted regression tests.

Scope: The Tier0 Enterprise error-handling path that includes container logs in error messages when dynamic application deployment fails.
Impact: If application logs contain connection strings or credentials, unfiltered deployment errors may expose them. Actual impact depends on the application log content.
Remediation: Deployment logs are filtered before error output, covering sensitive values in database connection strings, environment variables and JSON logs.
Timeline: Enterprise 2.0.0 was released on 2026-07-16 and is confirmed to include this fix.
Remediation & verification evidence: Based on Enterprise PR #181, deployment error handling in the 2.0.0 release, and direct regression tests.The record confirms a successful backend build and targeted project-domain tests. Redaction tests cover connection strings, environment variables and JSON logs. Verification does not extend to all log channels or historical data cleanup.

Reading versions & upgrades

Enterprise uses product versions. Cloud uses update release dates.

Affected

Enterprise lists verified product or component versions. Cloud lists relevant versions before the security update. Scope is limited to the features and usage scenarios described in each advisory.

Fixed in

Cloud YYYY-MM-DD identifies the update release date. Dates use Beijing time (UTC+8). Enterprise uses official product version numbers.

Images & upgrade packages

Remediation & evidence

STAY UP TO DATE WITH PRODUCT UPDATES, LEARNING RESOURCES, AND MORE.

Join Discord

Talk to Team

Security Advisories

Changelog

STAY UP TO DATE WITH PRODUCT UPDATES, LEARNING RESOURCES, AND MORE.

Join Discord

Talk to Team

Security Advisories

Changelog

STAY UP TO DATE WITH PRODUCT UPDATES, LEARNING RESOURCES, AND MORE.

Join Discord

Talk to Team

Security Advisories

Changelog