Pulse v6.1.0: Agent Command Execution Scope Fix and GHSA Dependency Patch

Pulse v6.1.0 Release Notes: Key Information Summary Vulnerability Overview Core Issues: v6.0.0 features a monitoring-first product line, a reviewed operational lifecycle, operator trust workflows, unified agent improvements, feedback validated by release candidates from to , plus final compatibility and reliability fixes at the time of the stable release. Key Fixes: - Integrated monitoring machines no longer appear as fictitious unified agent roles or misleading Agent Doctor targets. - Agent installation tokens carry command execution scope for requests and bind the command channel upon initial registration. - Manual agent update commands remain available before the update is actually applied; the replacement of binaries is self-tested. - TrueNAS storage reads the server API shape, CIFS membership resolves and namespace-suffixed references, and Proxmox disk usage utilizes a single normative vocabulary. - Patrol attention routing accepts valid scopes used by existing companion builds of relay-mobile, and validates core/mobile contract guard routing, methods, scopes, requests, responses, pairing, and push compatibility. - Patrol evaluation lookups recover new identifiers for active findings; operation sources preserve proposed evidence for review. - In-app updates select the highest valid version, wait for the new version to be served before reloading, and reject malformed release notes. - The DCM sanitization dependency includes the fix for . - ICMP permission failures explain the missing authorization; Docker, storage, OIDC, session, and native agent recovery paths retain additional fail-closed fixes demonstrated during release candidates. Scope of Impact Affected Versions: v6.0.0 and earlier versions. Affected Components: - Unified Agents: Reports only observer destinations, by destination identity, token, retry status, health checks, and audit retention. - Agent Doctor: Retains the last known platform to remove the agent, provides correct host-local uninstall commands, and does not imply remote removal privileges. - Monitoring: Disk health, metrics concurrency, audit retention, native updates, authentication, and installer recovery are more accurate and fail-closed across supported self-hosted paths. - The stable server contract is compatible with existing Pulse Mobile candidate builds and now provides relay-mobile tokens for Patrol attention access to companion requirements. Remediation Upgrade Recommendation: Upgrade to v6.1.0 using the standard v6 installation or update flow. Existing unified agent configurations remain valid during the update; no new observers were created. Windows Unified Agent: The Windows unified agent binary in v6.1.0 is not Authenticode signed and may display an "Unknown Publisher" warning. Verify the released checksum and detached or signature before installation. This is a single release owner exception; subsequent stable releases will restore the Windows Authenticode requirement. Rollback Target: v6.0.5. Exact rollback reinstall command: Pulse Mobile: Android version code 9 and iOS build 11 are compatible candidate builds. This server release does not update the compatible builds, nor does it trigger a public mobile storage rollback. Paid Pulse Pro Relay: Eligible legacy customers should continue to use the private download page and private runtime images to access paid runtime features. Improved self-service commercial plans or billing cycle transitions remain disabled and were not introduced by this release. POC/Exploit Code Docker Installation: Docker Compose: Update to use . Rollback Command:

Goal Reached Thanks to every supporter — we hit 100%!

Pulse v6.1.0: Agent Command Execution Scope Fix and GHSA Dependency Patch

More from this source