Anchore STIG Profiles Release Notes - 2026-10-20

Anchore STIG Profiles - 2026-10-20

rhel8 now implements the DISA RHEL 8 STIG V2R9, and rhel9 the DISA RHEL 9 STIG V2R10. The profiles published before this update implemented V2R7 (rhel8 2.7.0) and V2R4 (rhel9 2.4.0), so this update also includes the changes from the DISA releases in between (RHEL 8 V2R8, RHEL 9 V2R5 to V2R9). The update was published through the Anchore Data Service on 2026-10-20. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

Updated Profiles

Changes

• rhel8 has 371 controls (was 366). Added SV-284947, SV-284948, SV-284949, SV-288829, SV-288830 and SV-288831. Removed SV-230285, which is not in V2R9.
• rhel9 has 445 controls (was 453). Added SV-288832 and SV-288833. Removed 10 controls that are not in V2R10: SV-257829, SV-257836, SV-257987, SV-257988, SV-258002, SV-258062, SV-258076, SV-258172, SV-258226 and SV-258237.
• rhel8 now recognizes Podman and other container runtimes, not only Docker, so controls that do not apply to containers are reported as Not Applicable there too.
• The profile-inputs.yaml files for rhel8, rhel9 and nginx changed. For rhel8, inputs were added, removed or updated for version 2.9.0, for example pass_max_days: 180. For rhel9, inputs that no control reads were removed. If you pass one of these files with --stig-input-file, or keep your own copy, compare it with the new file.

Fixed: Evaluations That Stopped with an Error

• The previous rhel8 and nginx profile-inputs.yaml files set some inputs with the wrong type: rhel8 set root_ca_file as a string instead of a hash, and nginx set 10 true/false inputs as quoted strings. Evaluations run with either file, for example with --stig-input-file, stopped with an error and produced no results. Both files now use the declared types.

Fixed: Wrong Passes and Wrong Not Applicable

• rhel8 SV-230287 and rhel9 SV-258000 looked only for *.pem files, so they did not check the SSH private host key files in /etc/ssh. They now check them against mode 0600, as the STIG now requires (it was 0640). Host key files more permissive than 0600 now fail.
• rhel8 SV-230367 and rhel9 SV-258042 did not compare each user’s maximum password age, so local users without a limit (99999 days) passed. The checks now fail on images that have such users. The STIG now sets the maximum to 180 days (it was 60).
• rhel8 SV-230333, SV-230335, SV-230337, SV-230339, SV-230341, SV-230343, SV-230345, SV-244533 and SV-244534 (account lockout with faillock) were Not Applicable on RHEL 8.2 and later because of a wrong version check. They now apply there.

Other checks also changed with the new STIG releases, so compare your results after you rescan.

Update and Rescan

• After your deployment has synced the update, run anchorectl stig write-profiles again, then rescan RHEL 8 and RHEL 9 images. If you pass nginx/profile-inputs.yaml with --stig-input-file, also rescan NGINX images.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.
• Images that you do not rescan keep their previous results.