diff --git a/docs/issues/431-backup-cves.md b/docs/issues/431-backup-cves.md
index 6f89d281..0e75377b 100644
--- a/docs/issues/431-backup-cves.md
+++ b/docs/issues/431-backup-cves.md
@@ -29,25 +29,24 @@ All 6 HIGH are Debian 13.4 (trixie) base package CVEs.
## Steps
-- [ ] Rebuild the image from scratch:
+- [x] Rebuild the image from scratch:
`docker build --no-cache -t torrust/tracker-backup:local docker/backup/`
-- [ ] Re-scan: `trivy image --severity HIGH,CRITICAL torrust/tracker-backup:local`
-- [ ] Compare against the pass-1 baseline in
+- [x] Re-scan: `trivy image --severity HIGH,CRITICAL torrust/tracker-backup:local`
+- [x] Compare against the pass-1 baseline in
`docs/security/docker/scans/torrust-tracker-backup.md`
-- [ ] For each remaining CVE, check fix availability:
+- [x] For each remaining CVE, check fix availability:
-- [ ] Update `docs/security/docker/scans/torrust-tracker-backup.md` with the new
+- [x] Update `docs/security/docker/scans/torrust-tracker-backup.md` with the new
scan results
- [ ] **If HIGH count dropped**: post comment with before/after results; close #431
-- [ ] **If no change**: post comment documenting that Debian upstream has not yet
+- [x] **If no change**: post comment documenting that Debian upstream has not yet
patched these CVEs with a revisit note; close #431
## Outcome
-
-
-- Date:
-- Findings after rebuild (HIGH / CRITICAL):
-- Debian packages patched: yes / no
-- Decision: resolved / accepted risk
-- Comment/PR:
+- Date: Apr 15, 2026
+- Findings after rebuild (HIGH / CRITICAL): 6 HIGH / 0 CRITICAL (unchanged)
+- CVEs: CVE-2025-69720 (ncurses `infocmp`) and CVE-2026-29111 (systemd IPC)
+- Debian packages patched: no — both CVEs are `` minor issues; fixes only in forky/sid
+- Decision: **accepted risk** — neither CVE is reachable in our container's runtime (no `infocmp` call, no systemd PID 1)
+- Comment/PR: PR #457, comment on #431
diff --git a/docs/security/docker/scans/README.md b/docs/security/docker/scans/README.md
index 07f0be29..747da332 100644
--- a/docs/security/docker/scans/README.md
+++ b/docs/security/docker/scans/README.md
@@ -4,16 +4,16 @@ This directory contains historical security scan results for Docker images used
## Current Status Summary
-| Image | Version | HIGH | CRITICAL | Status | Last Scan | Details |
-| -------------------------------------- | ------- | ---- | -------- | ------------------------- | ------------ | ----------------------------------------------- |
-| `torrust/tracker-deployer` | trixie | 44 | 1 | ⚠️ Partial remediation | Apr 8, 2026 | [View](torrust-tracker-deployer.md) |
-| `torrust/tracker-backup` | trixie | 6 | 0 | ℹ️ Remediation no change | Apr 8, 2026 | [View](torrust-tracker-backup.md) |
-| `torrust/tracker-ssh-server` | 3.23.3 | 0 | 0 | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-ssh-server.md) |
-| `torrust/tracker-provisioned-instance` | 24.04 | 0 | 0 | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-tracker-provisioned-instance.md) |
-| `caddy` | 2.11.2 | 10 | 2 | ⚠️ Partial remediation | Apr 15, 2026 | [View](caddy.md) |
-| `prom/prometheus` | v3.11.2 | 4 | 0 | ✅ Remediated | Apr 14, 2026 | [View](prometheus.md) |
-| `grafana/grafana` | 12.4.2 | 4 | 0 | ⚠️ Partial remediation | Apr 8, 2026 | [View](grafana.md) |
-| `mysql` | 8.4 | 9 | 1 | ⚠️ Accepted risk (gosu) | Apr 15, 2026 | [View](mysql.md) |
+| Image | Version | HIGH | CRITICAL | Status | Last Scan | Details |
+| -------------------------------------- | ------- | ---- | -------- | ------------------------------------ | ------------ | ----------------------------------------------- |
+| `torrust/tracker-deployer` | trixie | 44 | 1 | ⚠️ Partial remediation | Apr 8, 2026 | [View](torrust-tracker-deployer.md) |
+| `torrust/tracker-backup` | trixie | 6 | 0 | ⚠️ Accepted risk (Debian ``) | Apr 15, 2026 | [View](torrust-tracker-backup.md) |
+| `torrust/tracker-ssh-server` | 3.23.3 | 0 | 0 | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-ssh-server.md) |
+| `torrust/tracker-provisioned-instance` | 24.04 | 0 | 0 | ✅ Remediated (vuln scan) | Apr 8, 2026 | [View](torrust-tracker-provisioned-instance.md) |
+| `caddy` | 2.11.2 | 10 | 2 | ⚠️ Partial remediation | Apr 15, 2026 | [View](caddy.md) |
+| `prom/prometheus` | v3.11.2 | 4 | 0 | ✅ Remediated | Apr 14, 2026 | [View](prometheus.md) |
+| `grafana/grafana` | 12.4.2 | 4 | 0 | ⚠️ Partial remediation | Apr 8, 2026 | [View](grafana.md) |
+| `mysql` | 8.4 | 9 | 1 | ⚠️ Accepted risk (gosu) | Apr 15, 2026 | [View](mysql.md) |
**Overall Status**: ⚠️ **CVE database update detected** - Most images still show increased vulnerability counts from previous scans (Feb-Dec 2025). Deployer has a first remediation pass applied (49 HIGH -> 44 HIGH, with 1 CRITICAL still open).
diff --git a/docs/security/docker/scans/torrust-tracker-backup.md b/docs/security/docker/scans/torrust-tracker-backup.md
index 44f8b54c..44098841 100644
--- a/docs/security/docker/scans/torrust-tracker-backup.md
+++ b/docs/security/docker/scans/torrust-tracker-backup.md
@@ -4,9 +4,9 @@ Security scan history for the `torrust/tracker-backup` Docker image.
## Current Status
-| Version | HIGH | CRITICAL | Status | Last Scan |
-| ------- | ---- | -------- | -------------------- | ----------- |
-| trixie | 6 | 0 | ℹ️ Base OS Monitored | Apr 8, 2026 |
+| Version | HIGH | CRITICAL | Status | Last Scan |
+| ------- | ---- | -------- | ------------------------------------ | ------------ |
+| trixie | 6 | 0 | ⚠️ Accepted risk (Debian ``) | Apr 15, 2026 |
## Build & Scan Commands
@@ -24,6 +24,56 @@ trivy image --severity HIGH,CRITICAL torrust/tracker-backup:local
## Scan History
+### April 15, 2026 - Remediation Pass 2 / Accepted Risk (Issue #431)
+
+**Image**: `torrust/tracker-backup:local`
+**Trivy Version**: 0.69.3
+**Scan Mode**: `--scanners vuln --severity HIGH,CRITICAL`
+**Base OS**: Debian 13.4 (trixie-slim)
+**Status**: ⚠️ **No change** — 6 HIGH, 0 CRITICAL
+
+#### Summary
+
+Image rebuilt from scratch with `--no-cache`. All Debian packages updated to latest trixie
+repository state. Vulnerability count unchanged: **6 HIGH, 0 CRITICAL**.
+
+| Target | HIGH | CRITICAL |
+| -------------------------------------------- | ---- | -------- |
+| `torrust/tracker-backup:local` (debian 13.4) | 6 | 0 |
+
+| CVE | Library | Severity | Status | Fixed Version | Title |
+| -------------- | ------------------------------------------------- | -------- | -------- | ------------- | --------------------------------------------------------- |
+| CVE-2025-69720 | libncurses6, libtinfo6, ncurses-base, ncurses-bin | HIGH | affected | — | ncurses: Buffer overflow in `infocmp` CLI tool |
+| CVE-2026-29111 | libsystemd0, libudev1 | HIGH | affected | — | systemd: Assert/freeze via spurious unprivileged IPC call |
+
+#### Debian Security Tracker Status
+
+Both CVEs confirmed as `` (minor issue) for trixie — Debian Security Team will not
+issue a DSA for stable trixie:
+
+- **CVE-2025-69720**: Fixed only in `forky/sid` (`ncurses 6.6+20251231-1`). Affects the
+ `infocmp` CLI tool (`progs/infocmp.c`) — **not the ncurses library itself**. Our backup
+ container never invokes `infocmp`.
+- **CVE-2026-29111**: Fixed only in `forky/sid` (`systemd 260.1-1`). Affects systemd when
+ running as PID 1 and receiving a spurious unprivileged IPC call. Our container runs a bash
+ script as entrypoint — **systemd is not PID 1**; `libsystemd0`/`libudev1` are installed as
+ transitive dependencies of other packages but the daemon is never started.
+
+#### Decision
+
+**Accepted risk — close issue #431.**
+
+- No fixes available in Debian trixie for either CVE
+- Both CVEs are marked `` minor issues by Debian Security Team
+- Neither CVE is reachable in our container's runtime behaviour:
+ - `infocmp` is never called
+ - systemd is not running as PID 1
+- The backup container has a minimal footprint, runs non-root, and is not network-accessible
+
+**Revisit**: When Debian trixie backports fixes for `ncurses` or `systemd`.
+
+---
+
### April 8, 2026 - Remediation Pass 1 (Issue #428)
**Image**: `torrust/tracker-backup:local`
diff --git a/project-words.txt b/project-words.txt
index 9291f9e5..242edefe 100644
--- a/project-words.txt
+++ b/project-words.txt
@@ -444,6 +444,12 @@ SCEP
DTLS
mysqlsh
syscall
+infocmp
+libncurses
+libtinfo
+libsystemd
+libudev
+behaviour
schemafile
schemars
scriptable