Skip to content

wagmios

v2.6.1 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 3d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

api docker docker-management self-hosted openclaw

Affected surfaces

auth breaking_upgrade deps

ReleasePort's take

Moderate signal
editorial:auto 3d

Stop trusting X-Forwarded-For by default; enforce rate limiting of API keys and validate Docker compose configurations for container names, image references, ports, env vars, and volume targets.

Why it matters: Mitigates spoofing attacks via X‑Forwarded‑For headers (severity 80) and prevents abuse through unrate‑limited API key usage (severity 70); mandatory validation of Docker compose elements reduces misconfiguration risk (severity 75).

Summary

AI summary

Updates Runtime and API hardening, Verification Validated before release, and Docker and path safety across a mixed release.

Changes in this release

Security High

Stop trusting X-Forwarded-For by default.

Stop trusting X-Forwarded-For by default.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Security High

Rate limit missing/invalid API keys by client IP and valid keys by key ID; public auth endpoints are rate-limited.

Rate limit missing/invalid API keys by client IP and valid keys by key ID; public auth endpoints are rate-limited.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Security High

Validate container names, image references, ports, environment keys/values, and volume targets; require host bind mounts under explicit absolute managed path.

Validate container names, image references, ports, environment keys/values, and volume targets; require host bind mounts under explicit absolute managed path.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Security High

Log auth/setup/rate‑limit failures as audit events for observability and security tracking.

Log auth/setup/rate‑limit failures as audit events for observability and security tracking.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Feature Medium

Bind frontend and backend to 127.0.0.1 by default for safer exposure.

Bind frontend and backend to 127.0.0.1 by default for safer exposure.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Feature Medium

Introduce `WAGMIOS_FRONTEND_BIND` and `WAGMIOS_BACKEND_BIND` environment variables for trusted LAN/reverse‑proxy deployments.

Introduce `WAGMIOS_FRONTEND_BIND` and `WAGMIOS_BACKEND_BIND` environment variables for trusted LAN/reverse‑proxy deployments.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Feature Medium

Add activity event IDs to logs.

Add activity event IDs to logs.

Source: llm_adapter@2026-05-31

Confidence: low

 —
Performance Medium

Serialize activity WebSocket writes per subscriber to reduce contention.

Serialize activity WebSocket writes per subscriber to reduce contention.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Bugfix Medium

Fix setup-token persistence to load existing first‑boot token before generating a new one.

Fix setup-token persistence to load existing first‑boot token before generating a new one.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Bugfix Medium

Preserve WebSocket upgrades when recording HTTP status codes by forwarding `Hijack()`/`Unwrap()` through the status recorder.

Preserve WebSocket upgrades when recording HTTP status codes by forwarding `Hijack()`/`Unwrap()` through the status recorder.

Source: llm_adapter@2026-05-31

Confidence: high

 —
Full changelog

WAGMIOS v2.6.1 — Runtime hardening follow-up

This follow-up release tightens the v2.6.0 security pass after additional autoreview and clean-runner testing.

Runtime and API hardening

  • Preserve WebSocket upgrades when recording HTTP status codes by forwarding Hijack()/Unwrap() through the status recorder.
  • Improve rate limiting:
    • missing/invalid API keys are limited by client IP
    • valid keys are limited by key ID
    • public auth endpoints are rate-limited
    • valid users no longer consume the shared pre-auth IP bucket
  • Stop trusting X-Forwarded-For by default.
  • Log auth/setup/rate-limit failures as audit events.
  • Add activity event IDs.
  • Serialize activity WebSocket writes per subscriber.
  • Fix setup-token persistence so an existing first-boot token is loaded before a new one is generated.

Docker and path safety

  • Validate container names, image references, ports, environment keys/values, and container volume targets.
  • Require host bind mounts to be under an explicit absolute managed host path.
  • Support named volumes by default; host bind mounts require WAGMIOS_HOST_CONTAINERS_DIR or absolute WAGMIOS_HOST_PATH.
  • Mirror host bind validation through the backend-visible containers directory to catch symlink escapes.
  • Add stricter symlink escape checks for existing parent directories when the final bind path does not exist.
  • Reject marketplace volume overrides until they are safely implemented.

Compose and docs

  • Bind frontend/backend to 127.0.0.1 by default.
  • Add WAGMIOS_FRONTEND_BIND and WAGMIOS_BACKEND_BIND opt-ins for trusted LAN/reverse-proxy deployments.
  • Keep the compose volume source and WAGMIOS_HOST_CONTAINERS_DIR aligned.
  • Document host bind mount environment variables and safe exposure defaults.

Verification

Validated before release:

  • gofmt clean
  • go test ./...
  • go vet ./...
  • pnpm install --frozen-lockfile
  • pnpm build
  • Autoreview loop with Codex CLI until clean
  • Crabbox static VPS clean-runner gate on Linux amd64
  • Scoped backend smoke test on Crabbox VPS
  • Backend Docker image health smoke
  • Frontend Docker image smoke

Docker images

Published tags:

  • itzmizzle/wagmi:backend
  • itzmizzle/wagmi:backend-latest
  • itzmizzle/wagmi:backend-v2.6.1
  • itzmizzle/wagmi:frontend
  • itzmizzle/wagmi:frontend-latest
  • itzmizzle/wagmi:frontend-v2.6.1

Security Fixes

  • Stop trusting X-Forwarded-For by default.
  • Log auth/setup/rate-limit failures as audit events.
  • Add activity event IDs and serialize WebSocket writes per subscriber.
  • Fix setup-token persistence to load existing first-boot token before generating a new one.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track wagmios

Get notified when new releases ship.

Sign up free

About wagmios

Your AI command Center

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]