DevOps Radar — Tue, May 12, 2026 (Kolson)

Note: `node scripts/research-web.mjs ...` fails here (`getaddrinfo ENOTFOUND duckduckgo.com`), so this report uses live public vendor sources instead.

## What’s new (for our stack)
- **Octopus Deploy:** Self-hosted “recommended” still shows **`2026.1 (Build 11411)`**; **Octopus Cloud** is shipping **`2026.2`** builds (latest shown **May 7, 2026: Build 9314**). citeturn0search2  
  - **`2026.2.x` operational change to plan for:** stopping/starting background work on UI nodes now requires a **server restart** when task cap is `0`; plus optional **OTel trace export to disk** for self-hosted diagnostics. citeturn2search2
- **Jenkins:** No newer advisory found since **`2026-04-29`**; that advisory still drives action (Credentials Binding, Script Security, GitHub/GH Branch Source, Matrix Auth, HTML Publisher, Microsoft Entra ID, etc.). citeturn7search1
- **Backstage:** The **`v1.50.x`** line remains the current “breakage boundary” (React 18 min + identity token/extension-config changes). Latest stable in that line shows **`v1.50.4` (Apr 29, 2026)**. citeturn0search0turn8search0
- **Atlassian (Data Center):** **Apr 21, 2026** bulletin remains the current driver: **31 high + 7 critical (3rd‑party)** across DC products → patch to fixed/latest versions. citeturn1search0
- **Teams (admin/security):** **May 06, 2026** adds **user-reported security signals** in TAC and enables a **numeric-only meeting passcode** option (with explicit warning). citeturn6view3
- **JBoss EAP / WildFly:** Red Hat shipped **JBoss EAP `7.4.24`** (replacement for `7.4.23`) with multiple security fixes; rated **Important**. citeturn5view0
- **Grafana (Public Dashboards risk cluster):**
  - **`CVE-2026-27877`**: Public Dashboards + **direct** datasources can expose datasource passwords; fixed in **`11.6.14 / 12.1.10 / 12.2.8 / 12.3.6 / 12.4.2`** trains. citeturn0search1
  - **`CVE-2026-27876` (Critical)**: potential RCE chain if **`sqlExpressions`** is enabled; fixed in the same trains; treat as “turn it off unless proven needed.” citeturn3search5turn9search0
  - **`CVE-2026-21722`**: Public Dashboard annotations time-range restriction bypass (visibility leak); fixed in patched builds (still relevant if Public Dashboards are on). citeturn2search0
- **Kibana:** April security updates still current; upgrade targets remain **`8.19.14 / 9.2.8 / 9.3.3`**. Key practical point: the **automatic import** DoS issue is **enabled by default in 8.15+** and is reachable by users with **Fleet/Integrations** privileges. citeturn1search1

## Source links
- Octopus release history + recommended/Cloud builds citeturn0search2
- Octopus `2026.2.x` release notes (UI-node background work + OTel traces) citeturn2search2
- Jenkins Security Advisory `2026-04-29` citeturn7search1
- Backstage `v1.50.0` notes + `v1.50.4` stable tag citeturn0search0turn8search0
- Atlassian DC Security Bulletin (Apr 21, 2026) citeturn1search0
- Teams admin release notes (May 06, 2026) citeturn6view3
- Red Hat CSAF `RHSA-2026:4917` (JBoss EAP `7.4.24`) citeturn5view0
- Grafana advisories: `CVE-2026-27877`, `CVE-2026-27876`, `CVE-2026-21722` + `sqlExpressions` docs citeturn0search1turn3search5turn2search0turn9search0
- Kibana ESA security update thread (upgrade targets + automatic import) citeturn1search1

## Why it matters (money + career + Allsite)
- **Money/uprightness:** Grafana Public Dashboards misconfig + `sqlExpressions` exposure and Kibana Fleet privilege sprawl are “one bad day” risks (credential leak / RCE blast radius / outages). citeturn0search1turn3search5turn1search1
- **Career + Allsite:** This is a clean packaged sprint: “advisory-driven hardening” with version gates, toggles, and RBAC reductions you can reuse as a repeatable client playbook (and interview story).

## How it improves our current stack (concrete)
- **Grafana:** Move to “Public Dashboards safe-by-default” (no direct datasources) + patched train + **`sqlExpressions` explicitly off** unless there’s a requirement. citeturn0search1turn9search0
- **Kibana:** Upgrade + immediately reduce who can reach the ESA class by

[trimmed]

Report history