Edit ndaal-sa-2026-042

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

This advisory records the introduction of the `dashboard-branding` CSAF 2.1 vendor extension across the ndaal CSAF Trusted Provider feed.  The extension carries operator-facing dashboard labels for the nvulnlookup `/dashboards/<slug>` web UI and is compliant with the OASIS CSAF 2.1 Draft 2+ vendor-extension mechanism (`document.x_extensions[]` array).

Three concrete artefacts ship together in this enrichment:

1. NEW extension content schema at
     `csaf/extensions/dashboard-branding_1.0.0.json` — JSON Schema
     describing the extension's payload object (publisher_brand,
     dashboard_short_name).  Self-referencing $id is
     `https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json`
     (SemVer-suffixed per the CSAF 2.1 extension URL regex).

2. NEW extension metadata file at
     `csaf/extensions/dashboard-branding-metadata_1.0.0.json`
     declaring `valid_locations: [{ path: '/document/x_extensions', max_occurrence: 1 }]`
     and `requirement: 'Optional'` so a CSAF consumer that does
     not understand the extension can safely ignore it.

3. ENRICHMENT of all 41 existing 2026 advisories (`ndaal-sa-2026-001`
     through `ndaal-sa-2026-041`) with one `document.x_extensions[]`
     element pointing at the new schema URL.  The element carries
     `publisher_brand: 'ndaal Advisories Database'` (rendered in
     the dashboard page <h1>) and `dashboard_short_name: 'ndaal'`
     (rendered in the navbar dropdown / breadcrumbs).  Each
     advisory's three sidecar files (`*.sha-256`, `*.sha-512`,
     `*.sha3-512`) were regenerated after the JSON edit.

The `csaf/provider-metadata.json` file additionally received
`publisher.x_publisher_brand` and `publisher.x_dashboard_short_name`
fields under `document.publisher.*` (CSAF 2.1 `provider.json`
schema does NOT set `additionalProperties: false` on the
publisher object, so the extension is spec-compliant at the
provider level).

Net effect on a v0.1.43+ deployment: when a downstream operator
mirrors the ndaal feed and feeds it into the nvulnlookup web UI,
the dashboard pages now render the operator-friendly brand label
('ndaal Advisories Database') in the page header and the short
label ('ndaal') in the navbar — without any code changes on the
consumer side, because the labels travel with the advisory.

This advisory itself carries the same `document.x_extensions[]`
element for consistency with the 41 enriched advisories.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel