<div class="container">
<h1>Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22770-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-21T16:05:47Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>critical</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236149">bsc#1236149</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257033">bsc#1257033</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257325">bsc#1257325</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257698">bsc#1257698</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257836">bsc#1257836</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257838">bsc#1257838</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257840">bsc#1257840</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258040">bsc#1258040</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258637">bsc#1258637</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258640">bsc#1258640</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258641">bsc#1258641</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259010">bsc#1259010</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259013">bsc#1259013</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259015">bsc#1259015</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259210">bsc#1259210</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259774">bsc#1259774</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1261829">bsc#1261829</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-15706">jsc#PED-15706</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-15820">jsc#PED-15820</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-13465.html">CVE-2025-13465</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-25547.html">CVE-2026-25547</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-26996.html">CVE-2026-26996</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-27904.html">CVE-2026-27904</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4631.html">CVE-2026-4631</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-4802.html">CVE-2026-4802</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13465</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13465</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13465</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13465</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-13465</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25547</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25547</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25547</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26996</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26996</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26996</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26996</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27904</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27904</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-27904</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4631</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4631</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4631</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4631</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4802</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4802</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4802</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-4802</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.2</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves six vulnerabilities, contains two features and has 11 fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:</p>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2025-13465: lodash: prototype pollution in the <em>.unset and </em>.omit functions can lead to deletion of methods from
global prototypes (bsc#1257325).</li>
<li>CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).</li>
<li>CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and
may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).</li>
<li>CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character
that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).</li>
<li>CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking
complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).</li>
</ul>
<p>Non security issues fixed:</p>
<ul>
<li>cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).</li>
<li>cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).</li>
</ul>
<p>Changes for cockpit:</p>
<ul>
<li>
<p>Update to 364.</p>
</li>
<li>
<p>Update to 361 (jsc#PED-15706/jsc#CPT-183):</p>
</li>
<li>
<p>Remove all "Mount" actions in Anaconda mode</p>
</li>
<li>
<p>Dependency updates</p>
</li>
<li>
<p>Update to 360:</p>
</li>
<li>ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631</li>
<li>
<p>ws: support loading a custom login page</p>
</li>
<li>
<p>Update to 358:</p>
</li>
<li>
<p>Networking: Add Wi-Fi support</p>
</li>
<li>Cockpit Client updated to GTK 4</li>
<li>
<p>Bugfixes and translation updates</p>
</li>
<li>
<p>Update to 357:</p>
</li>
<li>
<p>lib: Use browser context menu on shift</p>
</li>
<li>
<p>bridge: support Python 3.14 on old kernels (RHEL 8)</p>
</li>
<li>
<p>Update to 356:</p>
</li>
<li>
<p>systemd: Allow editing timers created by Cockpit</p>
</li>
<li>
<p>Convert license headers to SPDX format</p>
</li>
<li>
<p>Update to 355:</p>
</li>
<li>
<p>ws: Remove obsolete pam_cockpit_cert module</p>
</li>
<li>shell: add StartTransientUnit as a sudo alternative</li>
</ul>
<p>Changes for cockpit-machines:</p>
<ul>
<li>
<p>Update to 354.</p>
</li>
<li>
<p>Update to 352:</p>
</li>
<li>
<p>Improvements to the "Add disk" and "Create Volume" dialogs.</p>
</li>
<li>
<p>Update suse_version requirement to function with the planned bump (jsc#PED-15820).</p>
</li>
<li>
<p>Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).</p>
</li>
<li>
<p>Update to 348:</p>
</li>
<li>
<p>Translation updates</p>
</li>
<li>Convert license headers to SPDX format</li>
<li>
<p>Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl</p>
</li>
<li>
<p>Update to 347:</p>
</li>
<li>
<p>Bug fixes and translation updates</p>
</li>
<li>
<p>Fix esbuild for ppc64le (bsc#1257698).</p>
</li>
</ul>
<p>Changes for cockpit-packages:</p>
<ul>
<li>
<p>Update to version 5:</p>
</li>
<li>
<p>Support transactional systems</p>
</li>
<li>Improve error/success messages</li>
<li>
<p>Translation updates</p>
</li>
<li>
<p>Patch esbuild to use native runtime on ppc64 (bsc#1257698).</p>
</li>
</ul>
<p>Changes for cockpit-podman:</p>
<ul>
<li>Update to 128.</li>
<li>Fix esbuild for ppc64le (bsc#1257698).</li>
</ul>
<p>Changes for cockpit-repos:</p>
<ul>
<li>Update to 4.8.</li>
<li>Patch esbuild to use native runtime on ppc64 (bsc#1257698).</li>
</ul>
<p>Changes for cockpit-subscriptions:</p>
<ul>
<li>Update to version 16.2 (bsc#1257033).</li>
<li>Patch esbuild to use native runtime on ppc64 (bsc#1257698).</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.2
<br/>
<code>zypper in -t patch SUSE-SL-Micro-6.2-1309=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.2 (noarch)
<ul>
<li>cockpit-podman-128-160000.1.1</li>
<li>cockpit-networkmanager-364-160000.1.1</li>
<li>cockpit-machines-354-160000.1.1</li>
<li>cockpit-firewalld-364-160000.1.1</li>
<li>cockpit-system-364-160000.1.1</li>
<li>cockpit-kdump-364-160000.1.1</li>
<li>cockpit-selinux-364-160000.1.1</li>
<li>cockpit-repos-4.8-160000.1.1</li>
<li>cockpit-subscriptions-16.2-160000.1.1</li>
<li>cockpit-bridge-364-160000.1.1</li>
<li>cockpit-storaged-364-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
<ul>
<li>cockpit-ws-debuginfo-364-160000.1.1</li>
<li>cockpit-debugsource-364-160000.1.1</li>
<li>cockpit-364-160000.1.1</li>
<li>cockpit-ws-selinux-364-160000.1.1</li>
<li>cockpit-ws-364-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-13465.html">https://www.suse.com/security/cve/CVE-2025-13465.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-25547.html">https://www.suse.com/security/cve/CVE-2026-25547.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-26996.html">https://www.suse.com/security/cve/CVE-2026-26996.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-27904.html">https://www.suse.com/security/cve/CVE-2026-27904.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4631.html">https://www.suse.com/security/cve/CVE-2026-4631.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-4802.html">https://www.suse.com/security/cve/CVE-2026-4802.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236149">https://bugzilla.suse.com/show_bug.cgi?id=1236149</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257033">https://bugzilla.suse.com/show_bug.cgi?id=1257033</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257325">https://bugzilla.suse.com/show_bug.cgi?id=1257325</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257698">https://bugzilla.suse.com/show_bug.cgi?id=1257698</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257836">https://bugzilla.suse.com/show_bug.cgi?id=1257836</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257838">https://bugzilla.suse.com/show_bug.cgi?id=1257838</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257840">https://bugzilla.suse.com/show_bug.cgi?id=1257840</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258040">https://bugzilla.suse.com/show_bug.cgi?id=1258040</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258637">https://bugzilla.suse.com/show_bug.cgi?id=1258637</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258640">https://bugzilla.suse.com/show_bug.cgi?id=1258640</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258641">https://bugzilla.suse.com/show_bug.cgi?id=1258641</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259010">https://bugzilla.suse.com/show_bug.cgi?id=1259010</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259013">https://bugzilla.suse.com/show_bug.cgi?id=1259013</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259015">https://bugzilla.suse.com/show_bug.cgi?id=1259015</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259210">https://bugzilla.suse.com/show_bug.cgi?id=1259210</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259774">https://bugzilla.suse.com/show_bug.cgi?id=1259774</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1261829">https://bugzilla.suse.com/show_bug.cgi?id=1261829</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-15706">https://jira.suse.com/browse/PED-15706</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-15820">https://jira.suse.com/browse/PED-15820</a>
</li>
</ul>
</div>