Skip to main content

Stratusphere Hotfix & Security Update List

Ryan Wilp
  • Created:
  • Updated:

Which hotfix or security update should I apply to my Stratusphere appliances, and what does each one change?

The current Stratusphere update is 6.7.1-3, a security update for Hub, Database, and Collector appliances running 6.7.0-x or later. This article lists its changes and upgrade procedure, shows which update applies to each installed version, and keeps the fix history of earlier hotfixes in expandable sections.

Related articles
The CVEs resolved in each release are listed by CVE identifier and component in the Stratusphere UX — Third-Party & Open Source Software Inventory. For appliances below 6.7.0-x, see the Stratusphere Upgrade & Migration Guidance. For upgrade problems, see Troubleshooting 6.7.x Hotfix upgrade.

Which Update Applies

Find your installed version in /etc/tnt-release or on the console status page, then follow its row.

Installed version Path Notes
6.7.0-x or higher 6.7.1-3 Apply the current update.
6.7.0-5 6.7.0-5.20260414 Alternate if you are not ready for 6.7.1. Final 6.7.0-5 build; no security updates or fixes after April 14, 2026. See 6.7.0-5 Cumulative Hotfix.
6.6.x and earlier Upgrade & Migration ▶ 6.7.1-3 Follow the Stratusphere Upgrade & Migration Guidance.

Current Update — 6.7.1-3

Item Details
Version 6.7.1-3  ✓ Current  Security update  Updated 10-22-26
Build 6.7.1-3.20261001
Upgrade image stratusphere-6.7.1-3.img
tnt-release 6.7.1-3_202610010631.8c06955
Kernel 4.18.0-553.168.1.el8_10.x86_64
Connector ID Key 6.7.1-3
Image type Full upgrade image; applies to any appliance running 6.7.0-x or later

Security Updates

  • Applied 34 Oracle Linux 8 security advisories, including kernel updates to 4.18.0-553.168.1 and updates to openssh, libssh, libxml2, expat, glib2, sqlite, python3.12, microcode_ctl, unbound, vim-minimal, perl, apr-util, libevent, libtiff, qt5-qtbase, tar, wget, gzip, coreutils, and libkcapi.
  • Upgraded the NATS messaging server from 2.12.8 to 2.14.7 and the nats CLI from 0.3.1 to 0.5.0, and rebuilt nats-top, to address Critical and High severity vulnerabilities in their Go toolchains and embedded modules.
  • Upgraded the appliance service to Go 1.26.8 and updated google.golang.org/grpc to v1.83.2, golang.org/x/crypto to v0.57.0, and klauspost/compress to v1.18.7 to address High severity vulnerabilities.
  • Addressed an information disclosure where the appliance's HTTP-to-HTTPS redirect on port 80 returned the appliance's internal IP address in the Location header. The redirect now uses the configured host name, so the internal address is no longer exposed to an unauthenticated request.
CVEs resolved in this release
The 206 CVEs resolved in 6.7.1-3 are listed in the Stratusphere UX — Third-Party & Open Source Software Inventory.

Upgrade Procedure

Applies ONLY to 6.7.0-x and later
This procedure applies only to Stratusphere appliances running 6.7.0-x or later; the upgrade fails to apply on earlier versions. Confirm that every Hub, Database, and Collector shows 6.7.0-x or later on the console status page and in /etc/tnt-release before you start. For earlier versions, see Which Update Applies.

1. Download the Upgrade Image

On a desktop with Internet access, download stratusphere-6.7.1-3.img.

Online Upgrade
Hubs with Internet access will show the update at the top of the console status page and the Web UI, and Hub Administration > Upgrades > Online will download the image directly to the Hub.

Hub Administration Upgrades Online tab showing An update (6.7.1-3) is available for download

2. Take Snapshots

  • (Recommended) Shut down the Hub, Database, and Collector appliances and take a snapshot of each.
  • Power all appliances back on.
  • (Recommended) Keep the hypervisor console open for each appliance during the upgrade so you can watch its status, reboots, and uptime.
  • (Recommended) Confirm you have working passwords for the Web UI and the appliance console accounts (friend, ec2-user, azureuser, or any you changed from the defaults), so you can log in to monitor the upgrade if needed.
Command-line customizations
Customizations made in an appliance's command-line console, such as iptables firewall rules, internal configuration files, or custom users, may be lost during the upgrade. Record them before you start, and reapply them afterward if needed.

3. Upload the Image to the Hub

  1. Log in to the Administration section of the Hub Web UI and go to Hub Administration > Upgrades > Offline.
    • Alternatively, on a Hub with Internet access, use the Hub Administration > Upgrades > Online tab and click Download Update to download the image directly to the Hub, then skip to step 4, Install the Update on the Hub and Database.
  2. Click Browse or Choose File, select stratusphere-6.7.1-3.img, then click Upload Update. The progress bar shows "Upload in Progress (This might take several minutes)". The image is about 1.5 GB, so the upload can take a while depending on your network connection.
  3. When the upload finishes, the Hub shows "Download Completed. Verifying Image" while it checks the file, then "Upload Completed Successfully".

4. Install the Update on the Hub and Database

  1. Click Install Update. The progress bar shows "Install in Progress (This might take several minutes)."
  2. All services on the appliance stop, and the UI shows "Stratusphere is being upgraded after which the Hub will be rebooted. You will be logged out in 10 seconds. Please wait at least 15 minutes to log back in." You are logged out and see "Stratusphere is down".
  3. If a separate Database appliance is connected, it upgrades first and reboots automatically. The Hub then upgrades and reboots. Either appliance may reboot more than once.
  4. Wait at least 15-30 minutes after the Hub reboots, so all internal services can start, before you open the Web UI again.

To follow progress, watch the console status screen for "Updates are Running" and the uptime next to "top -". On AWS or Azure, connect over SSH with the appliance console credentials and run:

watch -c cat /tmp/status
If the upgrade does not complete
If the version did not change, the login page does not load, "Stratusphere is down" does not clear, or you see "HTTP Status 404 – Not Found" errors related to "The requested resource [/vscenter/] is not available" after logging in, see After upgrade, the Web UI displays a 404 Error in Troubleshooting 6.7.x Hotfix upgrade.

5. Upgrade the Collectors

  1. Go to Collector Administration > Collectors.
  2. Select each Collector, one at a time, and click Upgrade. Each Collector upgrades and reboots.
  3. After about 15 minutes, confirm each Collector shows Status OK.

6. Validate the Upgrade

Log in to each appliance and run the command below. The kernel and tnt-release versions should match the output shown.

$ uname -rv; rpm -q tnt-release
4.18.0-553.168.1.el8_10.x86_64 #1 SMP Mon Sep 28 05:46:21 PDT 2026
tnt-release-6.7.1-3_202610010631.8c06955.noarch

The banner at the bottom of the Web UI and the Version column on Collector Administration > Collectors should show 6.7.1-3 (20261001). Connector ID installers on Hub Administration > Connector ID Keys > Connector ID Key Software should show 6.7.1-3.

Collector_Admin_6.7.1-3.png

Connector ID Key Software tab showing Connector ID installer version 6.7.1-3

7. Update Connector ID Agents

Agents already on Connector ID Key 6.7.1-3 (shipped with 6.7.1-2) need no update. For persistent machines on an earlier version:

  1. Go to Hub Administration > Connector ID Keys > Connector ID Keys Properties.
  2. Select the machine group in Configure properties for.
  3. Select Automatically update Connector ID Keys when new software versions are installed in the Stratusphere Hub and click Save. The agents download and install the new version on their next callback.

For non-persistent machines, download the installer from Hub Administration > Connector ID Keys > Connector ID Key Software and update your gold image as described in the appendixes of the Stratusphere Installation & Configuration Guide.

PowerShell disabled
Machines with PowerShell disabled need the 6.7.0-10 or later Connector ID installer.

8. Verify Data Collection and Remove Snapshots

Wait a few hours so the agents can call back through their list of Collectors, then confirm that:

  • New data is being collected and saved in the database.
  • New data is visible in the Web UI.
Upgrade complete
Once the installation is verified, remove the snapshots from the Stratusphere appliances.

↑ Back to Contents

Previous Hotfixes

Each entry below lists the fixes in that hotfix or update. Starting with 6.7.1, every hotfix and security update is a full upgrade image that applies to any appliance running 6.7.0-x or later, so 6.7.1-3 is cumulative and includes every 6.7.1 fix listed here. CVEs resolved by each release are listed in the Stratusphere UX — Third-Party & Open Source Software Inventory.

6.7.1-2 (Build 20260825) — 9-16-26  SUPERSEDED BY 6.7.1-3

Build 6.7.1-2.20260825  |  Connector ID Key 6.7.1-3  |  Applies to 6.7.0-x and later

Security

  • Addressed High and Critical severity vulnerabilities in the appliance service dependencies, primarily by upgrading golang.org/x/crypto from v0.50.0 to v0.52.0.

Web UI

  • Fixed an issue where deep links from CommandCTRL into Diagnostics > Individual Views did not apply the machine filter, so the view opened without being scoped to the requested machine.
  • Fixed an issue where Diagnostics > Detailed Views left an empty Basis Search key pair in the JSON API call, which caused a "No records returned" message when filtering on a column such as Owner Name.
  • Removed placeholder tabs for future versions under Diagnostics > Individual Views.
  • Removed placeholder tabs for future versions under Overview that displayed as disabled.

CID Key

  • Fixed a security incompatibility that prevented earlier Connector ID Keys from obtaining a certificate from a Hub running at a higher security posture with EMS disabled, causing the TLS handshake and registration to fail. The fix is delivered in Connector ID Key 6.7.1-3.

Hub, Database & Collectors

  • Fixed a write gap in the tntdbconf utility, which wrote property changes directly into tntdb.conf and could expose a partial write to processes monitoring the file. The updated file is now put in place with an atomic rename, and the original is restored automatically if the replacement fails.
  • Fixed an issue where transparent CAC authentication failed when the User Principal Name on the CAC certificate did not match the letter case of the User Principal Name stored in Stratusphere.
  • Fixed an issue where CAC could not be enabled after a hotfix upgrade, because the smaller hotfix upgrade images did not contain the lwl-stig-base-dod-cac package.
  • Fixed a race condition where standalone backend services on a standalone Hub wouldn't start post-upgrade if the local database service took longer to start up.
6.7.0-5 Cumulative Hotfix (Final Build 20260414)  NO UPDATES AFTER 4-14-26

The 6.7.0-5 hotfix was released as a single cumulative image that was replaced with each build. The final build, 6.7.0-5.20260414, includes every change below and remains available in Cumulative Hotfix for Stratusphere 6.7.0-5 for appliances that are not ready for 6.7.1.

Applies ONLY to 6.7.0-5
These builds apply only to appliances already running 6.7.0-5; the upgrade fails on any other version. Appliances on any other version from 6.7.0-x on should apply 6.7.1-3, a full upgrade image, instead.
Hub build Connector ID Key Changes
6.7.0-5.20260414 6.7.0-14 Security updates. Final 6.7.0-5 build.
6.7.0-5.20260104 6.7.0-14 Not itemized in this list.
6.7.0-5.20251110 6.7.0-14
  • Enhanced messaging queue robustness for Hub/Collector appliances.
  • Added hotfix build information to the blue ribbon at the bottom of the Web UI.
6.7.0-5.20251003 6.7.0-14
  • Fixed a Connector ID Key service crash on machines with an NPU (Neural Processing Unit).
6.7.0-5.20250718 6.7.0-13
  • Resolved authentication credential issues when using API v1.
6.7.0-5.20250627 6.7.0-13
  • Hardware Monitoring: replaced third-party libraries with HWiNFO for more reliable CPU temperature monitoring.
  • Added the missing RPM on the Hub/Collector so the Connector ID Key can download the HWiNFO library.
6.7.0-5.20250610 6.7.0-11 (Linux)
6.7.0-12 (Windows)
  • Connector ID Key collects and uploads the User Principal Name (UPN) to uniquely identify and link users in hybrid Entra ID and on-premises AD environments.
  • UPNs are used to identify users and prevent duplicate license usage in hybrid environments, with case-insensitive UPN matching on the backend.
  • Added support for Unicon thin clients running eLux OS, and enhanced compatibility with macOS Sequoia (Linux CID).
  • Added support for Omnissa Horizon Remote Display, and resolved missing metrics for Dizzion Frame Remote Display (Windows CID).
  • Disabled detection of zombie processes on Windows, which caused application freezing in long-running Windows sessions.
  • Improved the CAC authentication module for the Web UI.
6.7.0-5.202505 6.7.0-11 Not itemized in this list.
6.7.0-5.20250430 6.7.0-10 Not itemized in this list.
6.7.0-5.CID-202503 6.7.0-10
  • Eliminated PowerShell scripts from the Connector ID Key Advanced Installer for improved security.
6.7.0-5.SU.202503 6.7.0-8 (unchanged) Not itemized in this list.
Known issue — Appliances running Postgres 12
Hub and Database appliances originally deployed on 6.6.2 and upgraded to 6.7.0-5 can fail to apply the cumulative hotfix with "Unexpected upgrade error". See 6.7.0-5 Hotfix: "Unexpected upgrade error" for Appliances running Postgres-12 for the workaround.
6.7.0-1 to 6.7.0-3  UPGRADE RECOMMENDED

Issues with linked hotfixes or workarounds for 6.7.0-1 through 6.7.0-3. Upgrade these appliances as shown in Which Update Applies.

↑ Back to Contents

Releases Before 6.7

Hotfixes for releases before 6.7 are documented in their own articles. Upgrade these appliances with the Stratusphere Upgrade & Migration Guidance.

6.6.2-2  SEE LINKED ARTICLES
6.6.1-1 and 6.6.1-2  SEE LINKED ARTICLES
6.6.0-1 and 6.6.0-2  SEE LINKED ARTICLES

Versions 6.5.1 and earlier are discontinued; see End-Of-Life For Versions of Stratusphere.

↑ Back to Contents

Troubleshooting

Product Liquidware Stratusphere UX
Applies To Stratusphere 6.7.x; earlier releases listed for reference
Updated October 22, 2026

Related articles