Security advisories

Telegraf Controller retrieves the security advisories that InfluxData publishes for Telegraf and Telegraf Controller, compares each advisory with the Telegraf version that every agent reports, and shows you which agents are affected. Use security advisories to find vulnerable agents quickly, plan upgrades, and confirm that a rollout removed the exposure.

• How advisories reach Telegraf Controller
• How advisories are matched to your fleet
• Where advisories appear
• License and permissions

How advisories reach Telegraf Controller

InfluxData publishes advisories as a signed JSON advisory file per product: one for Telegraf and one for Telegraf Controller. Each file is accompanied by a detached OpenPGP signature. Telegraf Controller verifies the signature against the InfluxData public key built into the application before it applies an advisory file. A file that fails verification is never applied.

An advisory file can reach Telegraf Controller in two ways:

• Automatic checks: by default, Telegraf Controller downloads the advisory files from InfluxData every 6 hours and applies any newer file. You can change the interval, point Telegraf Controller at an internal mirror, run a check on demand, or turn automatic checks off. See Configure automatic advisory checks.
• Manual import: for air-gapped deployments, download the advisory file and its signature on a connected machine and upload them through the Telegraf Controller UI or API. The file is verified offline, and Telegraf Controller rejects a file that is older than the one already applied unless you explicitly roll back. See Import an advisory file.

Both paths apply the same signed file, so an air-gapped instance sees exactly what a connected instance downloads.

How advisories are matched to your fleet

Each advisory lists the Telegraf version ranges it affects and the version that fixes it, along with a severity (Critical, High, Medium, or Low) and, when available, a CVSS score and vector.

Telegraf Controller evaluates every active advisory for Telegraf against the Telegraf version that each agent reports in its heartbeat and assigns the agent one of the following exposure states:

Exposure is evaluated against each agent’s most recently reported Telegraf version, so it updates as you upgrade agents. Every agent that Telegraf Controller tracks is counted, whatever its reporting status. Advisories that InfluxData withdraws are removed from the list and no longer count toward exposure.

Advisories for Telegraf Controller itself aren’t matched against agents. Instead, Telegraf Controller compares them with the version it is running. If the running version is affected, users with write permission see a banner on every page until Telegraf Controller is upgraded, and the advisory’s page reports whether this installation is affected. See Check your Telegraf Controller version.

Where advisories appear

• Security page: the Security page summarizes fleet exposure, shows the status of each advisory feed, and lists every active advisory with the number of affected agents.
• Agents page: an Advisories column shows each agent’s exposure, and an Advisory exposure filter narrows the list to affected agents or to a severity.
• Agent detail page: a Security Advisories card lists the advisories that affect the agent.
• Notification banners: when a newly applied advisory file matches agents in your fleet, a banner appears on every page until a user with write permission acknowledges it. A separate banner appears when the running Telegraf Controller version is affected by an advisory.

See Review advisories and affected agents.

License and permissions

Security advisories are part of Telegraf Enterprise. Without a valid Telegraf Enterprise license, the Security page shows an upgrade notice, the Advisories column and filter are hidden from the Agents page, and the /api/security-advisories endpoints return 403 Forbidden with the feature key security_monitoring. Automatic checks run only while Enterprise features are enabled. See Enterprise feature gating.

With a valid license, access is controlled by the security-advisories permission resource:

The Security navigation item appears for any user with read access. API tokens inherit the permissions of the user who created them. See Authentication and authorization.