# Athena Endpoint Platform appliance 0.8.1 Released 2026/10/19. Type: feature release. ## Downloads | File | Size | SHA-256 | |---|---|---| | `athena-update-0.8.1.tar` (update bundle for existing appliances) | 886.7 MB (929,730,560 bytes) | `8c486cc879cb12937d527e44a645e9f0eff92a452ce11703e5c1ce0d03c77d5e` | | `athena-0.8.1-sbom.zip` (SPDX 2.3 JSON SBOMs + CVE report) | 2,761 KB | `12a2831aab3561f6f1d027c722e882c96446dd0306bd61ba024741b805ecb10c` | Production-signed (YubiKey, signing key SHA-256 `b21ce633...cda05f5f`). No new VHDX/OVA images in this release: new installs use the 0.7.0 images and apply this bundle. Update bundles are signed with the Athena update key; the appliance verifies the signature and every file hash before it changes anything. Signing key fingerprint (SHA-256 of the public key, first 16 hex): `b21ce6334a281ebf`. ## What is inside | Component | Version | |---|---| | Athena server | 0.8.1 (image `athena-server:appliance-e2d86917`, ASP.NET Core runtime 8.0.32) | | Flatcar Container Linux (Stable) | 4757.2.1 - kernel 6.12.111, Docker 28.2.2 (unchanged from 0.7.0) | | PostgreSQL (optional, off by default) | 16.15 (unchanged; not carried in this bundle) | | Windows / Linux / macOS agent | 1.2.144 / 1.2.126 / 1.2.133 | | Remote helper | 1.3.28 | | PowerShell module / HermesCLI | 2.17.0 / 1.2.26 | ## Upgrade path - From 0.7.0 and later: upload `athena-update-0.8.1.tar` in Settings > Appliance > Updates (or the console, *13) Updates*), verify, apply. The appliance backs up the database, reboots, and rolls back on its own if the new version does not stay healthy. - This is a full bundle only (no delta): appliances on 0.7.0 cannot apply delta bundles. - PostgreSQL is not in the bundle; the appliance keeps its own PostgreSQL 16.15 image, which is the version this release needs. - The bundled agents (Windows 1.2.144, Linux 1.2.126, macOS 1.2.133) and remote helper 1.3.28 are registered automatically on the first start after the update, also when the admin password was changed. Agents themselves are not updated automatically - roll out the new agent from the web console. - Downgrades are not supported. ## Security fixes - Athena server image: ASP.NET Core runtime 8.0.31 -> 8.0.32 (GHSA-fpq8-4vhr-rcxx, GHSA-rv87-ccxw-8ggf, both Critical). - No OS change in this release (Flatcar 4757.2.1, as in 0.7.0). ## CVE report summary Scanned 2026/10/19 with grype v0.119.0 (database built 2026/10/18). After VEX triage (findings proven not reachable on the appliance removed); the full report and machine-readable JSON are in the SBOM download. | Component | Critical | High | Medium | Low | Fix available | |---|---:|---:|---:|---:|---:| | Athena server image | 0 | 0 | 7 | 1 | 0 | | Agents and helper | 0 | 0 | 0 | 0 | 0 | | Appliance files | 0 | 0 | 0 | 0 | 0 | | Flatcar OS (kernel + Go components) | 19 | 227 | 403 | 29 | 605 | Build policy: pass (no Critical finding with a fix available in what Athena builds). Flatcar's own OS packages (glibc, OpenSSL, systemd, ...) are not covered by this scan; their status is Flatcar's security advisories for 4757.2.1. Kernel findings are matched by NVD CPE and are an upper bound; they are fixed by a newer Flatcar release. ## Changes ### New - **Athena Agent Properties in Windows Control Panel.** The agent registers a Control Panel item that opens the remote helper's properties window: status, the policies applied to the machine, the local cache, and local actions. Every local action is audited on the server as its own event type, filterable on the Audit page. - **Shortcuts module (Policies > Shortcuts).** Desktop, Start menu and link shortcuts on Windows (.lnk/.url), Linux (.desktop) and macOS (Dock/alias), with Create / Replace / Update / Delete, for all users, every profile, or at sign-in. One policy wins per agent; the agent removes only shortcuts Athena created. Licensed as `module.shortcuts`; PowerShell cmdlets in module 2.17.0. - **Reveal a Secret credential.** A new permission, `credentials.reveal` (Helpdesk, Operator, Admin), adds an eye button on Secret credentials (and `POST api/credentials/{id}/reveal`, MCP). Each reveal is confirmed, shown for 30 seconds and audited (`CredentialSecretRevealed`); it fails closed if the audit cannot be written. Local and Domain passwords stay write-only. - **BIOS administrator password: set, change, remove, with escrow.** From an agent's BIOS tab (`bios.password`, Admin, `module.bios`) on Dell, HP and Lenovo. The password is held in a Secret credential, and the agent records which one (escrow); BIOS Remediate uses the escrowed password by default. - **Profile page layout.** API tokens are panel 03, permissions panel 04; panels 01 and 02 share a height. ### Fixed - Commands sent to an offline or disconnected agent, and commands that target only a tag, now finish instead of staying "Running" forever. - The agent update badge clears when the update completes, names the target version, survives a page reload, and stays visible when the update failed; the agent details page shows the same badge. - File pickers (HP BIOS password file, Sysmon config upload, Sync trusted CA, appliance web certificate) use the themed Browse button. - **Appliance:** the bundled agents and remote helper are registered by the server itself after an update. Before this, they were uploaded with the initial admin password, so on an appliance whose admin password was changed no update ever delivered new agents. The PowerShell module and HermesCLI downloads (`/downloads/...`) work again (they answered 404 under SELinux enforcing). - **Appliance console:** the initial admin password is no longer shown after an emergency password reset. ### Known issues - **Older trial licences do not unlock the new modules.** An update never replaces an installed licence. An appliance still on an older trial licence keeps BIOS, Restart Policies and Shortcuts switched off until a current licence is uploaded in Settings > License. - The BIOS password actions have not been run against real hardware yet. ## Documentation Installation guide, hardening statement and the previous release notes: .