[stackstate-agent] CVE-2026-14456 (openssl 3.5.7) — no upstream fix published, needs a tracked exception

[LouisParkin]

The agent image scan reports one unmanaged finding:

CVE-2026-14456 [HIGH] pkg:generic/openssl@3.5.7 [grype]

It appeared with the 2026-08-19 scanner database refresh, alongside CVE-2026-73500 (etcd, fixed in #486). It blocked #486's DEB build before #488 moved the scans to inform, so it is no longer blocking — but it is now unmanaged and will publish silently.

This is not a version bump

Grype reports the fix as 3.5.8, 3.6.4, 4.0.2. None of those exist. The newest 3.5.x release is 3.5.7 (2026-06-09), which is what we already pin, and openssl/openssl has zero tags matching openssl-3.5.8 or openssl-3.6.4. Grype is surfacing anticipated fix versions from the advisory, not shipped releases.

So the correct handling is an exception with status: accepted_pending_upstream_fix / reason: no_upstream_fix_published and a short review deadline, matching the existing CVE-2026-4360 entry — not a bump.

Proposed action

• Add exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml so the finding is managed rather than unmanaged. With gating off, managed-vs-unmanaged is the only remaining signal in the scan summary.
• Re-check upstream at the review deadline; bump as soon as a fixed release ships.

When a fix does ship, the pin lives in four coordinated places

• deps/openssl/version.bzl — OPENSSL_VERSION
• deps/repos.MODULE.bazel — sha256, strip_prefix, and both urls
• omnibus/config/software/openssl3.rb — default_version, plus the comment that documents why it tracks version.bzl
• the dd-agent-omnibus S3 mirror is listed first in urls; a new upstream version may not be mirrored there, so the openssl.org fallback has to work

Bumping only one of these will diverge the Bazel and omnibus builds.

Related

Several existing stackstate-k8s-agent exceptions carry expires: '2026-08-20' and need review at the same time.