Backend 0.101.7 security update for self-hosted Nuphos

Security

This release fixes several access-control issues and adds one guard for outbound requests to team-configured hosts. Nuphos Cloud has run with these fixes since 2026-10-22. Self-hosted backends on v0.101.6 or earlier are affected; upgrade to v0.101.7 or later (we recommend the latest release).

• Team role checks: some trigger, dashboard, tailnet session, database change and monitor routes allowed actions beyond the caller's team, role or the conversation's credential selection. These routes now check the team from the path and require the documented role.
• Outbound requests to team-configured hosts: Grafana, GitLab, SonarQube, Uptime Kuma and public-mode database connections could reach private, loopback, link-local or in-cluster addresses. All of them now go through one guard that resolves the host per request, refuses those destinations, pins the checked address and does not follow redirects. The Grafana proxy also stops forwarding caller headers and no longer returns raw upstream error bodies.

Self-hosted deployments on Kubernetes should set OUTBOUND_BLOCKED_CIDRS to the cluster's Service CIDR (the default blocks GKE's 34.118.224.0/20). OUTBOUND_ALLOW_PRIVATE_HOSTS replaces GITLAB_ALLOW_PRIVATE_HOSTS; the old name still works.

Upgrading from v0.101.5 or v0.101.6

1. No database changes. If you set GITLAB_ALLOW_PRIVATE_HOSTS, rename it to OUTBOUND_ALLOW_PRIVATE_HOSTS (optional; the old name still works). If any integration uses a private host, set OUTBOUND_ALLOW_PRIVATE_HOSTS=true. On Kubernetes, set OUTBOUND_BLOCKED_CIDRS to your cluster's Service CIDR. A backup is still recommended before any upgrade.
2. Update the image and restart:
   • Compose: check out backend-v0.101.7, rebuild the backend, and run docker compose up -d backend.
   • Railway: set the backend service image to ghcr.io/nuphos/backend:v0.101.7.
   • Zeabur: set the backend image to v0.101.7.
   • Helm: set backend.image.tag: v0.101.7 until a chart with appVersion 0.101.3 is published.
3. Check that /health returns 200.

Read the full backend v0.101.7 release notes.