Release Overview
Release Highlights
Proxmox: Modernized Bootdisk Workflow & Storage Selection
With orcharhino 7.11, the Proxmox bootdisk provisioning workflow has been overhauled for better security, reliability, and flexibility:
- API-Upload: The upload workflow now communicates directly with Proxmox VE via the native REST API instead of legacy SSH connections. This improves security and eliminates the need for separate SSH access configurations.
- Target Storage Selection: You can now explicitly define the target storage for bootdisk images directly in the Compute Profile or in the Virtual Machine settings during host creation. This gives administrators granular control in clustered environments where certain storage pools are limited to specific hypervisor nodes.
Tech Preview: Ansible Director – Proxy Support & New Variable Bindings
orcharhino 7.11 brings two major architectural enhancements to Ansible Director:
- Scale Across Networks with orcharhino Proxies: Ansible Director can now execute automation through distributed orcharhino Proxies. Proxies automatically fetch the designated Ansible Execution Environments (EE) from the central orcharhino server, ensuring containerized, identical execution environments across all network zones.
- Persistent Variable Bindings: We have completely redesigned variable management. Instead of tightly coupling variables to a specific Ansible content version — which previously required reconfiguring overrides after lifecycle promotions — orcharhino 7.11 introduces Variable Bindings. These bindings persist seamlessly across content version updates and can be managed directly on content, hostgroup, or host levels.
Tech Preview: STACKIT Cloud Integration via OpenTofu
With orcharhino 7.11 the multi-cloud capabilities are expanded. The OpenTofu-driven generic compute resource provider now supports STACKIT.
Deploy, provision, and decommission STACKIT virtual machine instances directly from orcharhino. Leverage standard cloud-init via custom userdata templates to automatically configure, register, and patch new STACKIT instances on first boot.
Changelog Features
- Content (deb): Added support to sync and publish the NotAutomatic and ButAutomaticUpgrades Release file fields.
- Content (Docker): Allow to push/pull to orcharhino container registry using the orcharhino Proxy certificates. This functionality can be enabled / disabled for each orcharhino Proxy. It is necessary to distribute the Execution Environments of the Ansible Director (TechPreview) to the various orcharhino Proxies.
- OpenVox/Puppet: Add KB article how to setup external OpenVox server attached to orcharhino Proxy: https://atixservice.zendesk.com/hc/en-001/articles/30654416764700
- orcharhino repository: We now provide „fail2ban“ and its dependencies for installation on orcharhino Server and orcharhino Proxy Servers.
- Proxmox: Replaced SSH-based ISO uploads with the Proxmox Upload API.
- Web UI: We extended the ‚All Hosts‘ page to have a new bulk action for changing the Puppet environment.
Changelog CVE
- CVE-2026-12405: When a job template has the effective_user property marked as overridable, the application fails to properly sanitize the effective_user input provided during the API request.
- CVE-2026-12540: In the ‚foreman-rake errors:fetch_log task‘, the ‚request_id‘ parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.
- CVE-2026-12541: In the ‚foreman-rake db:dump‘ and ‚db:import_dump‘ tasks, the application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution.
- CVE-2026-12542: The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the ‚eval‘ command.
- CVE-2026-12544: The foreman-rake initialization logic in ‚/usr/share/foreman/config/settings.rb‘ contains a vulnerable code pattern where configuration data is processed through two distinct executable layers.
- CVE-2026-12545: Hammer CLI: A local user running Hammer CLI can influence editor invocation to execute commands in the process context. If the tool runs with elevated privileges, this can result in privilege escalation.
- CVE-2026-33154: dynaconf prior to 3.2.13 is affected by remote code execution via insecure template evaluation.
- CVE-2026-42784: Sequoia-OpenPGP Auth Bypass Vulnerability
- CVE-2026-54284: An attacker with ability to supply input to sqlparse before 0.6.0 can trigger CPU DoS.
- CVE-2026-56097: The application failed to sanitize input parameters used in database queries within the RegistryProxiesController.
- CVE-2026-56098: The registry proxy revealed its internal state through differential responses to requests on the RegistryProxiesController, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
- CVE-2026-78679: GitPython before 3.1.59 contains an arbitrary file read vulnerability
- CVE-2026-79654: Fixed an issue where a user could read history from a content view in an organization the user has no access to.
- CVE-2026-90959: An authenticated user with low-privilege repository permissions could supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process.
- CVE-2026-96658: An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine.
- CVE-2026-96659: This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints.
Changelog Bugfixes
- Content (deb): Reclaim space feature did not work for deb content.
- Content (Python): Some packages present on orcharhino Server were not synchronized to orcharhino Proxy Server.
- Content (rpm): Incremental content view updates did not respect the content view’s dependency solving setting.
- Content (rpm): Some content imports failed with ’number of parameters must be between 0 and 65535′ error.
- Host Registration: When you register hosts to orcharhino, you must provide the default OS repositories and the orcharhino Client repository to the host during the registration workflow: https://docs.orcharhino.com/or/docs/sources/landing_page.html?page=managing_hosts/registering_hosts.html#registering-a-host-by-using-web-ui
- OpenSCAP: During the ansible scap client installation, the APT cache was not refreshed before installing the package.
- OpenSCAP: Allow creating bookmarks on the orcharhino Management UI for the OpenSCAP ARF Reports
- Openvox/Puppet: Fix parameter to set up OpenVox clients on hosts during host provisioning: https://docs.orcharhino.com/or/docs/sources/configuration_management/puppet.html#configuring-openvox-agent-on-a-host-during-provisioning
- Openvox/Puppet: The auto_complete_search API endpoint returned ‚500‘ error for ‚config_group‘ and ‚puppetclass‘ keywords.
- Provisioning (Bare Metal): Updated the Redfish Client used to communicate with bare metal hosts to version 0.9.0.
- Provisioning: Password length was not validated when editing a host.
- Provisioning: the registration of an Ubuntu 26.04 failed if the host has upgraded the packages before.
- Web UI: ‚All Hosts‘ page filter gave different results for Legacy UI and the current UI.
Tech Previews
- Ansible Director: Added documentation on how to perform consistency check to recover from failed Ansible content imports: https://docs.orcharhino.com/or/docs/sources/configuration_management/ansible_director.html#recover-from-failed-ansible-content-imports-by-using-web-ui
- Ansible Director: Added the rake task ‚foreman_ansible_director:create_staging_products‘ to create the internal product ‚internal_ad_execution_environment’ which stores the execution environment container images per organization.
- Ansible Director: All create, update and delete actions carried out through the WebUI now notify the user of their status through a toast notification. Further, backend errors are now being propagated to the frontend and displayed in a modal.
- Ansible Director: Documentation on how to remove job-specific container images built by Ansible Director from orcharhino Server.
- Ansible Director: Misleading colors were shown in the job output when applying Ansible configuration to a host.
- Ansible Director: The constraint to a single orcharhino Proxy has been lifted and Ansible Director can now be used on/across multiple orcharhino Proxies.
- Ansible Director: The management UI on the host/host group details page for Ansible variables and bindings has been redesigned and now allows full management of variables/bindings.
- OpenTofu: Add support for STACKIT cloud via image based deployment.
- OpenTofu: Added provider-specific connection fields to the compute resource form.
- OpenTofu: Added provider-specific constraints for compute attributes.
- OpenTofu: Improved error message readability in the UI.
