ESB-2026.6417

=========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2026.6417 Security update for elemental-system-agent 10 June 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: elemental-system-agent Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2026-33186 Original Bulletin: https://www.suse.com/support/update/announcement/2026/suse-su-202622053-1 Comment: CVSS (Max): 8.1 CVE-2026-33186 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N EPSS (Max): 0.0% (5th) CVE-2026-33186 2026-06-09 - --------------------------BEGIN INCLUDED TEXT-------------------- Security update for elemental-system-agent Announcement ID: SUSE-SU-2026:22053-1 Release Date: 2026-06-08T15:13:37Z Rating: important References: o bsc#1260277 Cross-References: o CVE-2026-33186 o CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N o CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N CVSS scores: /S:U/C:H/I:H/A:N o CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:N Affected o SUSE Linux Micro 6.2 Products: An update that solves one vulnerability can now be installed. Description: This update for elemental-system-agent fixes the following issue o CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260277). Changes: o Update to version 0.3.16: o setup for immutable releases (#274) o align system-agent image publishing for signed releases (#270) o Bumo github.com/docker/cli to v29.2.0 and go.opentelemetry.io/otel to v1.43.0 o run go mod tidy in /test folder o Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (bsc#1260277 CVE-2026-33186) o Bump github.com/docker/cli in /test o export CATTLE_NODE_NAME if SYSTEM_UPGRADE_NODE_NAME is set o use correct prefix for system-agent binary (#273) o checksum validation (#271) o Add validate subcommand for configuration validation (#250) o Update CODEOWNERS o Pin GH Actions to commit sha o chore: bump sles to 15.7 o Extend remote plan e2e tests o Fix agent restart issue and introduce constants o chore: bump go to v1.25 o Setup e2e test infrastructure o chores(deps): Bump k8s dependencies o Define linter rules o Fix CI failures o Introduce an extended Makefile o Switch workflows to use name makefile o Replace dapper with multi stage builds o Remove dapper scripts o Add multiple improvements for ignore files o fix: remove umask command from the system-agent unit-file o fix-system-agent-umask o [1.34] bumped dependencies for 1.34 support (#242) o Bump K8s patch level to 1.33.5 and Go patch level to 1.24.6 o fix: properly handle traps after unsuccessful SUC job execution o fix: do not unconditionally reset failure-counts o fix: remove resetFailureCountOnStartup, always reset failure counts on first start o un-rc wrangler and lasso o drop windows 2019 when running PR CI Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-906=1 Package List: o SUSE Linux Micro 6.2 (aarch64 x86_64) elemental-system-agent-0.3.16-160000.1.1 References: o https://www.suse.com/security/cve/CVE-2026-33186.html o https://bugzilla.suse.com/show_bug.cgi?id=1260277 - --------------------------END INCLUDED TEXT---------------------- You have received this e-mail bulletin as a result of your organisation's registration with AUSCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AUSCERT's members. As AUSCERT did not write the document quoted above, AUSCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AUSCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://portal.auscert.org.au/bulletins/ =========================================================================== AUSCERT The University of Queensland, Brisbane QLD 4072 Australia e: auscert@auscert.org.au t: +61 (0)7 3365 4417 Allies in Cyber Security ===========================================================================