---
title: Security advisories
description: Telegraf Controller retrieves signed InfluxData security advisories for Telegraf and Telegraf Controller, identifies which agents in your fleet run affected Telegraf versions, and notifies you when a newly published advisory matches your fleet.
url: https://docs.influxdata.com/telegraf/controller/security-advisories/
estimated_tokens: 2305
publisher: InfluxData
canonical: https://docs.influxdata.com/telegraf/controller/security-advisories/
date: '2026-10-21T08:34:21-06:00'
lastmod: '2026-10-21T08:34:21-06:00'
---

* Telegraf Enterprise

Telegraf Controller retrieves the security advisories that InfluxData
publishes for Telegraf and Telegraf Controller, compares each advisory with
the Telegraf version that every agent reports, and shows you which agents are
affected.
Use security advisories to find vulnerable agents quickly, plan upgrades, and
confirm that a rollout removed the exposure.

#### Available with Telegraf Enterprise

Security advisories are available with Telegraf Enterprise. If you are interested in learning more about Telegraf Enterprise,[contact us](https://www.influxdata.com/products/telegraf-enterprise/).

[ Upgrade to Enterprise](https://www.influxdata.com/products/telegraf-enterprise/)

* [How advisories reach Telegraf Controller](#how-advisories-reach-telegraf-controller)
* [How advisories are matched to your fleet](#how-advisories-are-matched-to-your-fleet)
* [Where advisories appear](#where-advisories-appear)
* [License and permissions](#license-and-permissions)

## How advisories reach Telegraf Controller

InfluxData publishes advisories as a signed JSON advisory file per product:
one for Telegraf and one for Telegraf Controller.
Each file is accompanied by a detached OpenPGP signature.
Telegraf Controller verifies the signature against the InfluxData public key
built into the application before it applies an advisory file.
A file that fails verification is never applied.

An advisory file can reach Telegraf Controller in two ways:

* **Automatic checks**: by default, Telegraf Controller downloads the
  advisory files from InfluxData every 6 hours and applies any newer file.
  You can change the interval, point Telegraf Controller at an internal
  mirror, run a check on demand, or turn automatic checks off.
  See [Configure automatic advisory checks](/telegraf/controller/security-advisories/configure-checks/).
* **Manual import**: for air-gapped deployments, download the advisory file
  and its signature on a connected machine and upload them through the
  Telegraf Controller UI or API.
  The file is verified offline, and Telegraf Controller rejects a file that
  is older than the one already applied unless you explicitly roll back.
  See [Import an advisory file](/telegraf/controller/security-advisories/import/).

Both paths apply the same signed file, so an air-gapped instance sees exactly
what a connected instance downloads.

## How advisories are matched to your fleet

Each advisory lists the Telegraf version ranges it affects and the version
that fixes it, along with a severity (**Critical**, **High**, **Medium**, or**Low**) and, when available, a CVSS score and vector.

Telegraf Controller evaluates every active advisory for Telegraf against the
Telegraf version that each agent reports in its[heartbeat](/telegraf/controller/agents/heartbeat-data/) and assigns the agent
one of the following exposure states:

|    Exposure    |                                                                                                     Meaning                                                                                                      |
|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|  **Affected**  |The agent’s Telegraf version falls inside an affected range of at least one active advisory. The agent is labeled with the highest severity among its matching advisories and the number of advisories that match.|
|**Not affected**|                                                                      The agent reports a Telegraf version that no active advisory affects.                                                                       |
|  **Unknown**   |                 The agent hasn’t reported a Telegraf version, or the reported value can’t be parsed as a release version (for example, a custom build string). Treat these agents as unverified.                 |

Exposure is evaluated against each agent’s most recently reported Telegraf
version, so it updates as you upgrade agents.
Every agent that Telegraf Controller tracks is counted, whatever its
reporting status.
Advisories that InfluxData withdraws are removed from the list and no longer
count toward exposure.

Advisories for Telegraf Controller itself aren’t matched against agents.
Instead, Telegraf Controller compares them with the version it is running.
If the running version is affected, users with write permission see a banner
on every page until Telegraf Controller is upgraded, and the advisory’s page
reports whether this installation is affected.
See [Check your Telegraf Controller version](/telegraf/controller/security-advisories/view/#check-your-telegraf-controller-version).

## Where advisories appear

* **Security page**: the  **Security** page
  summarizes fleet exposure, shows the status of each advisory feed, and lists
  every active advisory with the number of affected agents.
* **Agents page**: an **Advisories** column shows each agent’s exposure, and
  an **Advisory exposure** filter narrows the list to affected agents or to a
  severity.
* **Agent detail page**: a **Security Advisories** card lists the advisories
  that affect the agent.
* **Notification banners**: when a newly applied advisory file matches agents
  in your fleet, a banner appears on every page until a user with write
  permission acknowledges it.
  A separate banner appears when the running Telegraf Controller version is
  affected by an advisory.

See [Review advisories and affected agents](/telegraf/controller/security-advisories/view/).

## License and permissions

Security advisories are part of [Telegraf Enterprise](/telegraf/enterprise/).
Without a valid Telegraf Enterprise license, the **Security** page shows an
upgrade notice, the **Advisories** column and filter are hidden from the**Agents** page, and the `/api/security-advisories` endpoints return`403 Forbidden` with the feature key `security_monitoring`.
Automatic checks run only while Enterprise features are enabled.
See [Enterprise feature gating](/telegraf/controller/telegraf-enterprise/license-enforcement/#enterprise-feature-gating).

With a valid license, access is controlled by the `security-advisories`permission resource:

|            Role            |                                                       Permissions                                                        |
|----------------------------|--------------------------------------------------------------------------------------------------------------------------|
|**Owner**, **Administrator**|View advisories and affected agents, check for advisories, import advisory files, and acknowledge the notification banner.|
|  **Manager**, **Viewer**   |                                           View advisories and affected agents.                                           |

The **Security** navigation item appears for any user with read access.[API tokens](/telegraf/controller/tokens/) inherit the permissions of the user
who created them.
See [Authentication and authorization](/telegraf/controller/reference/authentication-authorization/#security-advisories).

## [Configure automatic advisory checks](/telegraf/controller/security-advisories/configure-checks/)

Control how Telegraf Controller retrieves InfluxData security advisory files: change the check interval, use an internal mirror, disable automatic checks for air-gapped deployments, run a check on demand, and read the feed status.

## [Import an advisory file](/telegraf/controller/security-advisories/import/)

Download the signed InfluxData advisory file and its signature on a connected machine and import them into an air-gapped Telegraf Controller through the UI or API.

## [Review advisories and affected agents](/telegraf/controller/security-advisories/view/)

Use the Security page in Telegraf Controller to review active security advisories, see which agents are affected, filter the Agents page by advisory exposure, acknowledge new advisories, and query the same data from the API.

#### Related

* [Telegraf Controller configuration options](/telegraf/controller/reference/config-options/)
* [Monitor agents](/telegraf/controller/agents/monitor/)
* [Telegraf Enterprise](/telegraf/enterprise/)
| Exposure | Meaning |
| --- | --- |
| Exposure | Meaning |
| Affected | The agent’s Telegraf version falls inside an affected range of at least one active advisory. The agent is labeled with the highest severity among its matching advisories and the number of advisories that match. |
| Not affected | The agent reports a Telegraf version that no active advisory affects. |
| Unknown | The agent hasn’t reported a Telegraf version, or the reported value can’t be parsed as a release version (for example, a custom build string). Treat these agents as unverified. |

| Role | Permissions |
| --- | --- |
| Role | Permissions |
| Owner ,  Administrator | View advisories and affected agents, check for advisories, import advisory files, and acknowledge the notification banner. |
| Manager ,  Viewer | View advisories and affected agents. |