SUSE-SU-2026:24709-1: important: Security update for elemental-operator, elemental-system-agent, elemental-toolkit

SLE-UPDATES null at suse.de
Fri Nov 13 08:30:50 UTC 2026 

# Security update for elemental-operator, elemental-system-agent, elemental-
toolkit

Announcement ID: SUSE-SU-2026:24709-1  
Release Date: 2026-11-09T15:42:43Z  
Rating: important  
References:

  * bsc#1265781
  * bsc#1266622
  * bsc#1266789
  * bsc#1272088
  * bsc#1277992
  * bsc#1278164
  * bsc#1279213
  * bsc#1279312
  * bsc#1279911
  * bsc#1279912
  * bsc#1279996

  
Cross-References:

  * CVE-2026-19201
  * CVE-2026-33814
  * CVE-2026-37236
  * CVE-2026-39821
  * CVE-2026-56852
  * CVE-2026-79775
  * CVE-2026-83530
  * CVE-2026-84303
  * CVE-2026-84304

  
CVSS scores:

  * CVE-2026-19201 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-19201 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-19201 ( NVD ):  6.6
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-19201 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33814 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33814 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33814 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33814 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-37236 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-37236 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  * CVE-2026-37236 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-39821 ( SUSE ):  9.1
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-39821 ( SUSE ):  7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-39821 ( NVD ):  9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-39821 ( NVD ):  8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-56852 ( SUSE ):  6.0
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56852 ( SUSE ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56852 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-79775 ( SUSE ):  7.1
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-79775 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-79775 ( NVD ):  7.1
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-79775 ( NVD ):  6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-83530 ( SUSE ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-83530 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-83530 ( NVD ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-83530 ( NVD ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-84303 ( SUSE ):  9.1
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-84303 ( SUSE ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-84303 ( NVD ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-84304 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-84304 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-84304 ( NVD ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  
Affected Products:

  * SUSE Linux Micro 6.0

  
  
An update that solves nine vulnerabilities and has two fixes can now be
installed.

## Description:

This update for elemental-operator, elemental-system-agent, elemental-toolkit
fixes the following issues:

  * CVE-2026-19201: github.com/google/go-attestation/attest: unbounded recursion
    in Windows ELAM parsing (bsc#1279911 bsc#1279912).
  * CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport
    when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265781).
  * CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client
    can override the HTTP method of a POST request through the X-HTTP-Method-
    Override header and bypass established access control (bsc#1277992).
  * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
    Punycode-encoded labels allows for validation bypass and privilege
    escalation (bsc#1266622 bsc#1266789).
  * CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on
    truncated/invalid UTF-8 input (bsc#1272088).
  * CVE-2026-79775: github.com/diskfs/go-diskfs: malformed SquashFS image can
    cause crashes and persistent CPU loops in rclone's archive backend
    (bsc#1278164).
  * CVE-2026-83530: github.com/google/cel-go/cel: no enforcement of expression
    size limit before source construction can lead to excessive resource
    consumption (bsc#1279996).
  * CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation
    issue allows for bypass of authorization policies via mixed-case or
    canonical-case header matches (bsc#1279312).
  * CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2
    DATA frame fragmentation (bsc#1279213).

Changes for elemental-operator:

  * Update to version 1.6.12:
  * Pin GH Actions to commit sha
  * Bump k8s.io/kubernetes v1.34.2
  * Fix unit tests after bumping libraries
  * Fix sporadic failures in unit tests
  * Bump github.com/rancher/yip v1.9.7
  * User Rewrite function instead of a Director function in ReverseProxy
  * Bump github.com/rancher-sandbox/go-tpm
  * Bump to golang 1.26
  * Bump github.com/google/go-attestation v0.6.4. Includes fixes for:
  * bsc#1279912 (CVE-2026-19201)
  * bsc#1279911 (CVE-2026-19201)
  * Bump test environment
  * Bump generators
  * Bump google.golang.org/grpc v1.83.2. Includes fixes for:
  * bsc#1279213 (CVE-2026-84304)
  * Bump github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0. Includes fixes for:
  * bsc#1277992 (CVE-2026-37236)
  * Bump github.com/rancher/wrangler/v3 v3.6.1. Includes
  * bsc#1272088 (CVE-2026-56852)
  * bsc#1279312 (CVE-2026-84303)
  * bsc#1266789 (CVE-2026-39821)
  * bsc#1266622 (CVE-2026-39821)
  * Bump wrangler from v2 to v3
  * Run make generate
  * Update controller runtime options
  * Do not allow installing unpinned go modules
  * Add a checksum validation for go-tpm code
  * Run make vendor
  * Updated cluster-api, steve, rancher/apis, client-go and k8s/api to the level
    they were at rancher v2.13

Changes for elemental-system-agent-pool:

  * Update to version 0.15.2:
  * fix: swap kubectl download to cowboy-builder rpm
  * Update module golang.org/x/crypto to v0.56.0 [SECURITY]
  * Update module google.golang.org/grpc to v1.83.2 [SECURITY]
  * Update module golang.org/x/mod to v0.40.0 [SECURITY]
  * Update module github.com/google/cel-go to v0.30.0 [SECURITY]
  * Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY]
  * Update module github.com/klauspost/compress to v1.18.7 [SECURITY]
  * [2.15] Bump go toolchain to 1.26.7 (#426)
  * Bump dependencies (#421)
  * Update README (#404)
  * add uninstall flag (#384)
  * some cve fixes, notably x/net and kubectl versions (#359)
  * Update actions/checkout action to v7
  * Update actions/upload-artifact action to v7
  * Update actions/setup-go action to v6.4.0
  * Update rancher/renovate-config digest to fc79cf4
  * Update registry.suse.com/bci/bci-micro Docker tag to v16
  * switch renovate over to the newer configuration (#293)
  * bump kubectl to 1.36.1 (#292)
  * add release branches to renovate config (#289)
  * Fix swapped kubectl checksums in SUC release image build (#286)
  * Document versioning schema and branch strategy aligned with Rancher minor
    releases (#280)
  * bumping CAPI to v1.13.2 and wrangler unrc version
  * bump k8s v1.36
  * fix logs collection
  * test: add new Plan State integration tests
  * chore: bump rancher/rancher/pkg/plan to consume Plan States
  * test: add e2e tests for Plan States lifecycle
  * feat: Adapt code to use Plan States
  * Add README.md for integration tests
  * Improve comments in scripts and logging
  * Adapt test framework code to use new pkg/plan library from rancher/rancher
  * Add test/vendor to .gitignore
  * Utilize new pkg/plan library from rancher/rancher
  * bump the fallback version to v0.3.16
  * add initial version of integration tests This version includes fixes for:
  * bsc#1277992 (CVE-2026-37236)
  * bsc#1272088 (CVE-2026-56852)
  * bsc#1265781 (CVE-2026-33814)
  * bsc#1266622 (CVE-2026-39821)
  * bsc#1279996 (CVE-2026-83530)
  * bsc#1279312 (CVE-2026-84303)
  * bsc#1279213 (CVE-2026-84304)

Changes for elemental-toolkit-pool:

  * Update to version 2.1.7:
  * Fix logging messages
  * Bump k8s.io/mount-utils v0.33.3
  * Bump actions/cache/save from 5.0.5 to 6.1.0
  * Bump actions/setup-go from 6.4.0 to 6.5.0
  * Bump actions/cache/restore from 5.0.5 to 6.1.0
  * Bump docker/login-action from 4.2.0 to 4.4.0
  * Move to go1.26
  * Bump github.com/rancher/yip v1.9.7. Includes fixes for:
  * bsc#1278164 (CVE-2026-79775)
  * Add dependency review workflow
  * Bump github.com/onsi/ginkgo/v2 v2.32.2
  * Bump github.com/containerd/containerd v1.7.36. Includes fixes for:
  * bsc#1272088 (CVE-2026-56852)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro 6.0  
    zypper in -t patch SUSE-SLE-Micro-6.0-957

## Package List:

  * SUSE Linux Micro 6.0 (aarch64 x86_64)
    * elemental-toolkit-2.1.7-159998.1.1
    * elemental-register-1.6.12-159998.1.1
    * elemental-support-1.6.12-159998.1.1
    * elemental-system-agent-0.15.2-159998.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-19201.html
  * https://www.suse.com/security/cve/CVE-2026-33814.html
  * https://www.suse.com/security/cve/CVE-2026-37236.html
  * https://www.suse.com/security/cve/CVE-2026-39821.html
  * https://www.suse.com/security/cve/CVE-2026-56852.html
  * https://www.suse.com/security/cve/CVE-2026-79775.html
  * https://www.suse.com/security/cve/CVE-2026-83530.html
  * https://www.suse.com/security/cve/CVE-2026-84303.html
  * https://www.suse.com/security/cve/CVE-2026-84304.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1265781
  * https://bugzilla.suse.com/show_bug.cgi?id=1266622
  * https://bugzilla.suse.com/show_bug.cgi?id=1266789
  * https://bugzilla.suse.com/show_bug.cgi?id=1272088
  * https://bugzilla.suse.com/show_bug.cgi?id=1277992
  * https://bugzilla.suse.com/show_bug.cgi?id=1278164
  * https://bugzilla.suse.com/show_bug.cgi?id=1279213
  * https://bugzilla.suse.com/show_bug.cgi?id=1279312
  * https://bugzilla.suse.com/show_bug.cgi?id=1279911
  * https://bugzilla.suse.com/show_bug.cgi?id=1279912
  * https://bugzilla.suse.com/show_bug.cgi?id=1279996

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20261113/d1da9d8a/attachment.htm>

More information about the sle-updates mailing list