OpenCVE (Docker) — Installation & Operation

→

Architecture

OpenCVE consists of a web app, a database (PostgreSQL), a cache/queue (Redis) and a scheduler/worker that regularly fetches and indexes CVE data from the official sources. You subscribe to vendors/products, and the platform notifies you of changes.

In your pipeline: OpenCVE is the trigger layer. When a relevant CVE appears, OpenCVE calls a webhook → your n8n workflow enriches it → the result lands in the CVE dashboard. See the CVE enrichment workflow. Prerequisite: Docker.

→

Compose stack

official

OpenCVE provides an official Compose setup. The easiest path is to clone their repo and use the bundled docker-compose.yml + .env, since the scheduler/worker and web app share configuration.

1 · Get the official compose setup

# check github.com/opencve/opencve for the latest structure/version
git clone https://github.com/opencve/opencve.git
cd opencve

Versions and service names can change between releases — verify against their documentation before running.

2 · Configure .env

# copy the example and fill in secrets
cp .env.example .env
nano .env
# set POSTGRES_PASSWORD, SECRET_KEY (openssl rand -hex 32),
# mail settings and optionally START_URL / public hostname

3 · Start the stack

docker compose up -d
docker compose ps

Expected services: webapp, postgres, redis, scheduler and one or more workers.

Bind to localhost: Make sure the web app port is exposed only on 127.0.0.1 in compose and placed behind your Nginx reverse proxy — not directly to the internet. See the Docker+UFW trap in the Docker guide.

→

Initialization & CVE import

On first startup the database must be migrated, a superuser created, and the initial CVE dataset imported. The first import is large and can take a while.

Migrate & create superuser

docker compose exec webapp \
  opencve upgrade
docker compose exec webapp \
  opencve create-user lars admin@defencia.dk --superuser

Command names can vary between versions — check opencve --help in the container.

Initial data import

docker compose exec webapp \
  opencve import-data
# fetches CVE/CWE/vendor data — takes time the first time

Scheduler: After the first import, the scheduler keeps the database updated automatically on an interval. Check that the scheduler and worker containers are running and not logging errors.

→

Subscriptions

The core of OpenCVE: subscribe to the vendors and products relevant to your environment, so you only get noise from what matters.

Step	Action
Find vendor/product	Search in Vendors/Products — e.g. Microsoft, Fortinet, Cisco, the products you actually run
Subscribe	Subscribe to a vendor (all products) or specific products
Organizations	Group subscriptions into org/project if you separate environments
Notification	Choose email and/or webhook per subscription/organization

Curate tightly: Like your 71 RSS feeds, the value is in the curation. Subscribe only to what your organization actually uses — otherwise the important CVEs drown in noise.

→

Webhook notifications

to n8n

This is where OpenCVE connects to your automation. Create a webhook notification that points to your n8n webhook URL, so each relevant CVE triggers the enrichment workflow.

Setup

# In the OpenCVE UI:
# Settings/Notifications → Add → Webhook
# URL: https://n8n.defencia.dk/webhook/opencve-cve
# Choose which subscriptions/severities trigger it
# Optionally add a secret header for validation in n8n

OpenCVE POSTs a JSON payload with CVE ID, change type and metadata to your endpoint.

Next step: n8n receives the payload and enriches the CVE (CVSS, EPSS, KEV, affected products) before it lands in the dashboard. That entire flow is described in the CVE enrichment workflow.

→

Operation

Logs & status

docker compose ps
docker compose logs -f scheduler
docker compose logs --tail=50 webapp

Update

git pull
docker compose pull
docker compose up -d
docker compose exec webapp opencve upgrade

Always run migrations (upgrade) after an image update.

Backup database

docker compose exec postgres \
  pg_dump -U opencve opencve > opencve_$(date +%F).sql

Force a manual CVE sync

docker compose exec scheduler \
  opencve import-data # or the relevant sync command

→

Hardening

Control	Recommendation
Exposure	Web app behind Nginx + HTTPS, bind to `127.0.0.1`
Database/Redis	On the `internal` network, no host ports
SECRET_KEY	Strong, unique, stored in Bitwarden
Webhook	Secret header/token so only OpenCVE can trigger n8n
Login	Superuser with a strong password; Fail2ban on login
Mail	Use an app password/SMTP relay, not a personal password
Updates	Follow releases — vulnerability data requires a healthy scheduler