SUSE-CU-2026:11539-1: Security update of suse/kubectl

Sun Oct 4 08:00:45 UTC 2026

SUSE Container Update Advisory: suse/kubectl
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:11539-1
Container Tags        : suse/kubectl:1.37 , suse/kubectl:1.37.0 , suse/kubectl:1.37.0-1.61.16 , suse/kubectl:latest , suse/kubectl:stable
Container Release     : 61.16
Severity              : important
Type                  : security
References            : 1281104 1281112 CVE-2026-85731 CVE-2026-85732 
-----------------------------------------------------------------

The container suse/kubectl was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4417-1
Released:    Fri Oct  2 11:19:00 2026
Summary:     Security update for helm
Type:        security
Severity:    important
References:  1281104,1281112,CVE-2026-85731,CVE-2026-85732
This update for helm fixes the following issues:

- CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar
  extraction (bsc#1281104).
- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network
  probing (bsc#1281112).

Changes for helm:

- Update to version 3.22.0:
 * chore(deps): bump the k8s-io group across 1 directory with 6 updates
 * bump version to 3.22 (#32606)
 * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362)
 * chore(deps): bump the k8s-io group with 7 updates (#32573)
 * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563)
 * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554)
 * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542)
 * [dev-v3 backport] deps: bump google.golang.org/grpc at v1.82.1 for GO-2026-6061 (#32536)
 * fix: bump go.opentelemetry.io/otel at v1.44.0 for GO-2026-5158 (#32535)
 * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6
 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
 * chore(deps): bump the k8s-io group with 7 updates
 * chore(deps): bump github/codeql-action/upload-sarif (#32449)
 * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2
 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2
 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2
 * chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#32381)
 * chore(deps): bump github/codeql-action/upload-sarif (#32382)
 * ci: auto-label PRs targeting dev-v3 (#32340)
 * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32331)
 * chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32332)
 * chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 (#32357)
 * chore(deps): bump github/codeql-action/upload-sarif (#32360)
 * chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 (#32359)
 * chore(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#32356)
 * chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 9.3.0 (#32354)
 * chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#32353)
 * chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#32310)
 * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308)
 * chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#32306)
 * fix(engine): prevent Files.Lines panic on empty file
 * fix: drop containerd v1 dep to resolve govulncheck CVEs
 * chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
 * chore(deps): bump github.com/cyphar/filepath-securejoin
 * chore(deps): bump the k8s-io group with 2 updates
 * chore(deps): bump the k8s-io group across 1 directory with 2 updates
 * fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1
 * chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
 * chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
 * chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
 * chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
 * ci: bump golangci-lint to v2.11.3 for go 1.26
 * chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
 * chore(deps): bump github.com/distribution/distribution/v3
 * chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32
 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
 * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13
 * chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
 * fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026
 * chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
 * chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0
 * [v3] Bump to version v3.21 (#32103)
 * [v3 backport] Fix rollback for missing resources
 * fix(action): avoid nil REST client getter panic when installing CRDs

The following package changes have been done:

- helm-3.22.0-150000.1.99.1 updated
- container:suse-sle15-15.7-c1583946d1da8b1467ad6591d109137f056ebd28624567435953d1a497f30a10-0 updated