Mender blog

Two security vulnerabilities recently discovered and fixed in Mender Server.

Security vulnerability enabling signature verification bypass in Mender Client version 5.0.0 to 5.0.3.

An ethical hacker on our HackerOne private bug bounty program recently discovered and disclosed access control issues with device groups in Mender Server.

A customer recently notified us of a security issue in Mender. On some versions, mender-auth generates private key files with non-strict file permissions.

Recently discovered security vulnerabilities in Mender Server have been fixed.

A customer recently notified us of a security issue in Mender. For users of RBAC and device groups, one specific API did not filter devices correctly.

CVE-2024-37019 is an account-takeover vulnerability in Mender Enterprise which was fixed in versions 3.6.4 and 3.7.4.

We recently discovered vulnerabilities in Mender Enterprise which relate to access control. Low-privileged read-only users had access to editing settings they were not supposed to edit and see potentially sensitive information which was not necessary.

We recently discovered a vulnerability in the Mender Client versions 3.2.0, 3.2.1, and 3.2.2. The client listens on a random, unprivileged TCP port and exp