FlawAtlas
Search the atlas
SUSE-SU-2026:22050-1 Not scored

Security update for elemental-register

This update for elemental-register fixes the following issue - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260277). Changes: - Update to v1.9.2: * 71d1fb9c Local node labels (#984) * ce6acda9 Bump golang.org/x/net to v0.55.0 includes fixes for: - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679 * 060958b7 Bump golangci/golangci-lint-action * 3b4b6699 use a real UUID for the machine registration ID * d33faa01 Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186) * 6dceb411 Deterministic endpoints for MachineRegistrations (#975) - Update to v1.9.1: * b42116d4 Ensure the machine inventory selector keeps looking for a match - Update to v1.9.0: - Update to v1.9.0-rc1: * 9952ebe1 Update libraries based on dependency scan * 5e128c5d Adapt OBS packages to a 1.9 version to coexist with 1.8 version * f88219af Fix cluster api version in test environment * ad937279 Run 'make generate' to recreate generated code and vendor folder * 15bb505f Bump to cluster API libraries to v1.12.x * 63369022 Bump test environment tools in Makefile * 7b464802 Run 'make vendor' to recreate vendor folder * 879b3464 Bump yip * aeda10ac Fix unit tests after bumping libraries * 33dcb61a Run 'make vendor' to recreate vendor folder * 0ccd96af Bump wrangler from v2 to v3 * ff0190c4 Run 'make generate' to renew all generated code and config files * b28d2f08 Bump controller generator to version 0.19 * 0bf7dc32 Update controller runtime options * 549e720d Run 'make vendor' to recreate vendor folder * 3f0f27e0 Updated cluster-api, steve, rancher/apis, client-go and k8s/api to the level they were at rancher v2.13 * 49ebf0b7 Update headers to 2026 * fd13ba92 Update questions to include SL Micro 6.2

Exploit probability Not scored
Published June 8, 2026
Required by Not available
Last source change June 10, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Micro 6.2 elemental-register

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2026:22050-1

This update for elemental-register fixes the following issue - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260277). Changes: - Update to v1.9.2: * 71d1fb9c Local node labels (#984) * ce6acda9 Bump golang.org/x/net to v0.55.0 includes fixes for: - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679 * 060958b7 Bump golangci/golangci-lint-action * 3b4b6699 use a real UUID for the machine registration ID * d33faa01 Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186) * 6dceb411 Deterministic endpoints for MachineRegistrations (#975) - Update to v1.9.1: * b42116d4 Ensure the machine inventory selector keeps looking for a match - Update to v1.9.0: - Update to v1.9.0-rc1: * 9952ebe1 Update libraries based on dependency scan * 5e128c5d Adapt OBS packages to a 1.9 version to coexist with 1.8 version * f88219af Fix cluster api version in test environment * ad937279 Run 'make generate' to recreate generated code and vendor folder * 15bb505f Bump to cluster API libraries to v1.12.x * 63369022 Bump test environment tools in Makefile * 7b464802 Run 'make vendor' to recreate vendor folder * 879b3464 Bump yip * aeda10ac Fix unit tests after bumping libraries * 33dcb61a Run 'make vendor' to recreate vendor folder * 0ccd96af Bump wrangler from v2 to v3 * ff0190c4 Run 'make generate' to renew all generated code and config files * b28d2f08 Bump controller generator to version 0.19 * 0bf7dc32 Update controller runtime options * 549e720d Run 'make vendor' to recreate vendor folder * 3f0f27e0 Updated cluster-api, steve, rancher/apis, client-go and k8s/api to the level they were at rancher v2.13 * 49ebf0b7 Update headers to 2026 * fd13ba92 Update questions to include SL Micro 6.2

View original source

05 / REFERENCES

Further evidence