What Security-Onion-Solutions/securityonion shipped
Written by FoxPlug from public releases; not affiliated with Securityonion. An automatic summary of the public release, pull request and commit data of github.com/Security-Onion-Solutions/securityonion. Securityonion did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 14, 2026
What shipped
- Isolated the Kratos and Hydra admin API on a dedicated soauth docker network to prevent unauthorized access via host network exposure. Pull request #16221
- Fixed privilege escalation vulnerability where unprivileged service UIDs owned
/usr/sbinmanagement scripts executed by root. Pull request #16250 - Fixed code execution vulnerability where so-minion exported unescaped install variables into Salt pillar rendering. Pull request #16246
- Fixed SOC user creation failing when passwords met requirements, with error messages now properly surfaced instead of hidden in logs. Pull request #16255
- Fixed SOC config screen rendering failure caused by docker.networks setting name conflict introduced in the previous release. Pull request #16253
- Fixed so-sensor-clean runaway loop that could fill logs with 1.1 GB in five hours by adding progress checks and pass limits. Pull request #16243
- Corrected Salt-installed management script ownership to prevent privilege escalation from service UIDs to root. Pull request #16250
- Fixed suricata.fileinfo boolean handling to properly represent missing file bytes instead of incorrect long values. Pull request #16249
- Added case-insensitive matching for ESQL and overrode default ESQL runtime parameters. Pull request #16247
- Fixed Zeek shutdown to terminate gracefully and preserve post-termination logs. Pull request #16242
Why it matters
This week addresses several security vulnerabilities including network isolation of authentication APIs, privilege escalation bugs, and code injection risks. A regression from the previous release broke user creation and config rendering, both now fixed. Performance and operational stability improvements prevent cleanup loops and log runaway issues.
Changelog entry
- Isolate Kratos and Hydra admin API on dedicated soauth docker network Pull request #16221
- Fix ownership of /usr/sbin management scripts and Salt default tree to prevent privilege escalation Pull request #16250
- Fix so-minion pillar injection vulnerability and disk.usage handling Pull request #16246
- Fix SOC user creation with valid passwords and improve error messaging Pull request #16255
- Fix config tree error from docker.networks setting conflict Pull request #16253
- Prevent so-sensor-clean runaway loop and concurrent instances Pull request #16243
- Fix suricata.fileinfo boolean gap handling in file.bytes.missing Pull request #16249
- Add case-insensitive ESQL matching and override default runtime parameters Pull request #16247
- Stop Zeek gracefully to preserve post-terminate logs Pull request #16242
This week: fixed three security vulnerabilities in network isolation, privilege escalation, and pillar rendering. Resolved regressions in user creation and config screens. Improved sensor cleanup and Zeek shutdown behavior.
This week's updates address critical security improvements and operational stability. Fixed network isolation for authentication APIs, patched privilege escalation vulnerabilities in management scripts and pillar rendering, and resolved user-facing regressions in account creation and configuration. Additional improvements prevent runaway cleanup processes and ensure Zeek terminates gracefully.