**Related issue:** Resolves#47524
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
## Context
[CVE-2026-34182](https://nvd.nist.gov/vuln/detail/CVE-2026-34182) (CVSS
9.1, Critical) is an OpenSSL CMS `AuthEnvelopedData` input-validation
flaw fixed in `openssl 3.5.7-r0`. The Alpine base image used by
`fleetdm/fleet` ships `3.5.6-r0`, which scanners (Aikido, Trivy) flag on
our published image.
`fleet serve` itself is statically compiled and does not link OpenSSL,
so the running process is unaffected — but the package is present in the
base image and shows up in customer-side SBOM scans.
## Approach
The issue's preferred path is a base-image SHA bump to `alpine:3.23.5`.
Docker Hub's latest `3.23.x` tag is still `3.23.4` (pushed 2026-04-15),
so that path isn't yet available. Applying the issue's fallback:
```dockerfile
RUN apk --no-cache upgrade openssl libcrypto3 libssl3
```
This pulls the patched `openssl 3.5.7-r0` from the Alpine 3.23 repos at
image build time without waiting on a new base tag. Once `alpine:3.23.5`
lands we can revert to a clean SHA-pinned `FROM` bump per the pattern in
#43671.
## Scope
Limited to `tools/fleet-docker/Dockerfile` per the issue's scope
guidance. Other Dockerfiles pinned to the same Alpine SHA (loadtest,
scep, mdmproxy) are out of scope here.
## Test plan
- [ ] CI image build passes.
- [ ] Trivy/scanner re-scan of the resulting `fleetdm/fleet` image
confirms CVE-2026-34182 is gone and `openssl` reports `3.5.7-r0`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated OpenSSL and related packages in Docker image build
configuration to ensure the latest versions are included during image
creation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#43671.
Bumps the Alpine base image from 3.23.3 to 3.23.4 in the Dockerfiles
that produce published images, picking up patched openssl, musl, and
zlib packages. Follows the same pattern as #38977.
### CVEs resolved
- HIGH: CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790,
CVE-2026-2673, CVE-2026-40200
- MEDIUM: CVE-2026-27171, CVE-2026-6042, CVE-2026-22184
### Test plan
- CI image build passes.
- Trivy/ECR scan on the resulting fleetdm/fleet image confirms the nine
listed CVEs are gone.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Docker base images to Alpine 3.23.4 across infrastructure and
deployment components for improved stability and security.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Updates alpine from
`alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412`
->
`alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375`
in `fleet/tools/fleet-docker/Dockerfile`
For #25748.
Manually tested by:
1. Building a `fleet` executable for Linux on a Ubuntu VM (with
`-extldflags "-static"`) for Alpine.
2. Placing the executable in `tools/fleet-docker`.
3. Building a local docker image using `docker build -t
fleetdm/fleet:v42.42.42 --platform=linux/amd64 .`.
4. Running the docker image (using `docker run`) and use Fleet on the
browser.
```
docker run -v $(pwd)/../osquery:/run -p 8412:8412 -e FLEET_MYSQL_ADDRESS=host.docker.internal:3306 -e FLEET_MYSQL_DATABASE=fleet -e FLEET_MYSQL_USERNAME=fleet -e FLEET_MYSQL_PASSWORD=insecure -e FLEET_REDIS_ADDRESS=host.docker.internal:6379 -e FLEET_SERVER_ADDRESS=0.0.0.0:8412 -e FLEET_SERVER_CERT=/run/fleet.crt -e FLEET_SERVER_KEY=/run/fleet.key -e FLEET_LOGGING_JSON='true' -e FLEET_VULNERABILITIES_CURRENT_INSTANCE_CHECKS="yes" -e FLEET_VULNERABILITIES_DATABASES_PATH=/vulndb -e FLEET_LOGGING_DEBUG='true' -it fleetdm/fleet:v42.42.42
```
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
Kept the Debian-based image at Bullseye.
For #24517.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality: Validated builds
(Docker and make) all work after this change, except for BitLocker
(requires Windows).
Note: This ensures that we are using the latest stable base images
possible and that they are tagged/pinned to images we have confidence
in. Note: Not pinning in `tools/fleet-docker/Dockerfile` was a large
oversight as it was the Dockerfile used in releases.
* Remove email address for redudancy
Call to actions at the bottom of the page offer better forms of communication to join the community, trial Fleet, or ask questions.
* Remove email mention
* Remove email mention
* Remove email mention
Leon Xu