[catch-21]

Outcome

The dashboard image embeds cloudflared 2026.10.3. cloudflared before 2026.10.2 still trusts eight eMudhra/emSign intermediate certificates whose private keys are weak. Someone who recovers those keys can forge a certificate for any name and intercept or modify traffic the tunnel authenticates with TLS.

Cloudflare's 20 October 2026 advisory tells Cloudflare Tunnel operators to upgrade to 2026.10.2 or later and, for containers, to redeploy the fixed image: https://blog.cloudflare.com/emudhra-certificate-compromise

2026.10.3 (published 21 October 2026) is the current release. Its notes are a distroless/Debian base-image bump and a Go toolchain bump on top of 2026.10.2, which is the release that moved cloudflared to Go 1.27.3 and refreshed the distroless image. This PR pins 2026.10.3.

What changed

• Dockerfile: the embedded binary now comes from cloudflare/cloudflared:2026.10.3@sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39. The copy path is still /usr/local/bin/cloudflared. Connect and Preview are the flows that spawn this binary.
• CHANGELOG.md: a security note under the existing unreleased 0.1.33 heading, beside the Node.js 24.22.1 fix from fix: pin the image to Node.js 24.22.1 security release, release 0.1.33 #112. Version stays 0.1.33. No tag. The historical ## [Unreleased] section at the bottom is the pre-version baseline and is untouched.
• Cloudflare guide (src/app/(protected)/cloudflare-guide/page.tsx): the example command stays cloudflare/cloudflared:latest. It only shows where the tunnel token appears. A short note under that command tells anyone who already ran cloudflared by hand to pull the latest image and recreate that container.

Repo search for other pins: the Dockerfile was the only cloudflared version pin. src/lib/server/tunnel-credentials.ts mentions 2026.5.2 as the source revision the token-to-credentials field copy was checked against. The e2e fake binary prints 2026.6.0. Those are records of behaviour, so they stay.

Digest check

GET /v2/cloudflare/cloudflared/manifests/2026.10.3 on registry-1.docker.io returned:

• Docker-Content-Digest: sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39
• media type application/vnd.docker.distribution.manifest.list.v2+json

Platform	Manifest
linux/amd64	sha256:c3f24df7c5e68c1467afc5486c155689f247eb02246b3a124fc5f42458728672
linux/arm64	sha256:e2fa661d7fabf0c0d57cf4ae602aec0b92551b7acd8d11bd286e82212ce29182

docker pull of that index, then /usr/local/bin/cloudflared --version:

• linux/amd64: cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
• linux/arm64: cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)

Image build

docker buildx build --load of this Dockerfile succeeded for linux/amd64 and linux/arm64. The Next.js production build completed inside the builder stage. Each image was started with the entrypoint overridden to /usr/local/bin/cloudflared --version (the dashboard server was not started):

• amd64 image: cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
• arm64 image: cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)

The copied binary matches the upstream image byte for byte on each architecture (sha256:919cd4640a5984b57ed420f1dd61e4155ee60abb52ac5fe2adb5f8dc71d0c2e5 on amd64, sha256:063a79bf7c948c68d4067dc65213b4a0594ff5df379925a6a4742b5bb873cb1c on arm64).

Follow-up in the Umbrel app store

pubky/umbrel-app-store pubky-homeserver/docker-compose.yml still pins cloudflare/cloudflared:2026.5.2@sha256:12ff5c6992a9863db4da270746af7c244bcaee49353039af8104268a18d6c4f0 on both cloudflared and cloudflared-preview. Those are the connectors Umbrel keeps running. This image only supplies the binary for the dashboard's Connect and Preview setup flows. The compose pin needs the same bump before a published tunnel is on 2026.10.3.

Release

No tag and no package.json bump. 0.1.33 remains the unreleased version that already carries the Node.js 24.22.1 pin (#112), so the two security fixes can ship together.