Kener Docs
llms.txt
Search Documentation
Search through all documentation pages
v4.x

v4.1.9 Changelog

See what's new in Kener v4.1.9, a security fix for the v4 API key check

Release date: October 24, 2026

Important

This release fixes a security issue in v4.0.0 to v4.1.8. A request could reach every /api/v4 route without an API key. Upgrade now, then follow What to do.

Security

Requests reached the v4 API without an API key

Field Value
Affected versions v4.0.0 to v4.1.8
Fixed in v4.1.9
Severity Critical, CVSS 3.1 score 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness CWE-288 (Authentication Bypass Using an Alternate Path), CWE-172 (Encoding Error)

Every /api/v4 route needs an API key. The check tested the raw request path for the /api/ prefix, but SvelteKit decodes the path before it matches a route. A request for /%61pi/v4/monitors (%61 is the letter a) matched the monitors route and skipped the check. So anyone who could reach your Kener instance could use the whole v4 API with no key: read and change monitors, incidents, maintenances, pages, and site data, and upload images.

Kener now decides from the route that SvelteKit matched, so a percent-encoded path gets the same 401 as a plain one. API clients that send a key see no change.

What to do:

  1. Upgrade to v4.1.9.
  2. Search your access logs for requests to the v4 API whose first path segment is not the plain text api, for example /%61pi/v4/monitors or /a%70i/v4/monitors. A hit means someone used the API without a key.
  3. If your instance was reachable from a network you do not trust, review your monitors, incidents, maintenances, pages, and site data for changes you did not make.
  4. GET /api/v4/monitors returned each monitor's URL, headers, body, and heartbeat secret. Treat a literal token stored there as exposed and rotate it. A $SECRET reference exposes only the variable name, not its value. Make a new heartbeat secret for each heartbeat monitor.
  5. If you ran v4.1.3 to v4.1.6, GET /api/v4/site also returned the OIDC client secret and the captcha secret key in plain text. Rotate both as v4.1.7 describes.

API keys were not readable. Kener stores only their hash, and no v4 route returns them.

Bug fixes

  • A malformed id gets a 404. GET /api/v4/incidents/abc and /api/v4/incidents/0 returned 500, and /api/v4/incidents/12abc acted on incident 12. An incident or maintenance id must now be digits only, at most 2147483647, or the route returns the NOT_FOUND JSON before it queries the database. The same applies to /api/v4/maintenances/{maintenance_id}.