Issues

• [Bug]: actorcrash while modifying workerpool replicas from 4 to 2

  kind/bug
  agent-substrate/substrate#2130 · Filter by author linsun opened on Oct 2, 2026
  

• The scheduler text and ErrNoCapacity still say "free worker"

  area/observabilitykind/cleanup
  agent-substrate/substrate#2128 · Filter by author JeffLuoo opened on Oct 2, 2026 · M3
  

• The router reports a shed request as unavailable after a full fleet

  area/observabilitybug-bashprio/P2
  agent-substrate/substrate#2127 · Filter by author JeffLuoo opened on Oct 2, 2026 · M3
  

• [Bug]: the version cmd only prints ate plugin version

  kind/bug
  agent-substrate/substrate#2126 · Filter by author linsun opened on Oct 2, 2026

• After a node restart, ate-api-server keeps dialing the old atelet IP until it restarts

  agent-substrate/substrate#2116 · Filter by author eren23 opened on Oct 2, 2026

• Public Documentation with Limitations

  agent-substrate/substrate#2106 · Filter by author SHRUTI6991 opened on Oct 2, 2026 · M3

• E2E Test, Manual Test, Security Regression Test across all authorization runtime check

  agent-substrate/substrate#2103 · Filter by author SHRUTI6991 opened on Oct 2, 2026 · M3

• ActorTemplate: replace on_pause/on_commit/on_resume with capture_scope and minimum_resume_scope

  area/apiprio/P0
  Task

  agent-substrate/substrate#2102 · Filter by author zoez7 opened on Oct 2, 2026 · M3
  

• Minimum Postgres security posture For GA

  agent-substrate/substrate#2097 · Filter by author EItanya opened on Oct 1, 2026 · M3
  1

  

• [Security] Unvalidated CDI Host Mounts & RuntimeAssetPaths in ateom

  area/nodearea/securitykind/bug
  agent-substrate/substrate#2091 · Filter by author destijl opened on Oct 1, 2026 · M3
  1

• [Security] Arbitrary Device Node Creation and Unfiltered Overlay Xattrs in Snapshot Tar

  area/nodearea/securitykind/bug
  agent-substrate/substrate#2090 · Filter by author destijl opened on Oct 1, 2026 · M3
  2

  

• [Security] ServiceAccount and Node Identity Spoofing in podcertcontroller

  area/identityarea/securitykind/bug
  agent-substrate/substrate#2089 · Filter by author destijl opened on Oct 1, 2026
  1

• [Security] Rogue Worker Pod Registration via Unverified Pod Label Selector

  area/schedulingarea/securitykind/bug
  agent-substrate/substrate#2088 · Filter by author destijl opened on Oct 1, 2026
  2

• [Security] Unauthenticated Actor Ingress and Cross-Tenant Wakeup via atenet-router

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2087 · Filter by author destijl opened on Oct 1, 2026 · M3
  2

  

• [Security] SSRF via atenet-egress Allows Actors to Reach Cloud Metadata & Internal APIs

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2086 · Filter by author destijl opened on Oct 1, 2026
  1

  

• [Security] Sandbox Asset Cache TOCTOU / Cache Poisoning via Writable BasePath

  area/gvisorarea/securitykind/bug
  agent-substrate/substrate#2085 · Filter by author destijl opened on Oct 1, 2026
  1

• [Security] WorkerPool Privilege Laundering into Root SYS_ADMIN HostPath Pods

  area/securitykind/bug
  agent-substrate/substrate#2084 · Filter by author destijl opened on Oct 1, 2026
  2

• [Security] Snapshot Upperdir Symlink Traversal & Host Deletion Outside Actor Dir

  area/gvisorarea/microVMarea/securitykind/bug
  agent-substrate/substrate#2083 · Filter by author destijl opened on Oct 1, 2026
  2

  

• [Security] Image Layer Cache Poisoning via Unverified DiffID Keying

  area/nodearea/securitykind/bug
  agent-substrate/substrate#2082 · Filter by author destijl opened on Oct 1, 2026 · M3
  1

• [Security] atelet AteomSupport MintActorCertificate Does Not Bind Requesting Ateom to Actor

  area/securitykind/bug
  agent-substrate/substrate#2081 · Filter by author destijl opened on Oct 1, 2026 · M3
  

• [Security] Node GCP Credentials Used Unconditionally for Tenant Image Pulls

  area/securitykind/bug
  agent-substrate/substrate#2080 · Filter by author destijl opened on Oct 1, 2026 · M3
  2

• [Security] CSI Controller TLS Skips Hostname Verification when serverName is Unset

  area/securitykind/bug
  agent-substrate/substrate#2079 · Filter by author destijl opened on Oct 1, 2026 · M3
  1

  

• [Security] Router Upstream mTLS Accepts Any Pod SPIFFE Identity in Trust Domain

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2078 · Filter by author destijl opened on Oct 1, 2026 · M3
  1

  

• [Security] Snapshot Manifest / StorageLocation Path Traversal & Unverified Asset Execution

  area/securitykind/bug
  agent-substrate/substrate#2077 · Filter by author destijl opened on Oct 1, 2026
  1

• [Security] Cloud Hypervisor Snapshot config.json Arbitrary Host File Exposure

  area/microVMarea/securitykind/bug
  agent-substrate/substrate#2076 · Filter by author destijl opened on Oct 1, 2026
  1