Security update for elemental-operator
This update for elemental-operator fixes the following issue - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277). Changes for elemental-operator: - Fix substitution - Fix reference in labels - Adapt labels to pass OBS container checks - Update to version 1.6.11: * Bump unit test environment artifacts * Bump test environment tools in Makefile * Bump actions * Refresh auto-generated code (make run) * Bump controller generator to version 0.19 * Bump golangci/golangci-lint-action * Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186) * Update spec and Dockerfiles to use go1.25 * Bump golang.org/x/net to v0.55.0, includes fixes for: - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679 * Update year in header * Remove labeler workflow
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for elemental-operator fixes the following issue - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277). Changes for elemental-operator: - Fix substitution - Fix reference in labels - Adapt labels to pass OBS container checks - Update to version 1.6.11: * Bump unit test environment artifacts * Bump test environment tools in Makefile * Bump actions * Refresh auto-generated code (make run) * Bump controller generator to version 0.19 * Bump golangci/golangci-lint-action * Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186) * Update spec and Dockerfiles to use go1.25 * Bump golang.org/x/net to v0.55.0, includes fixes for: - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679 * Update year in header * Remove labeler workflow
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1251679
- https://bugzilla.suse.com/1260277
- https://bugzilla.suse.com/1265921
- https://bugzilla.suse.com/1266789
- https://bugzilla.suse.com/1267168
- https://bugzilla.suse.com/1267197
- https://www.suse.com/security/cve/CVE-2025-58190
- https://www.suse.com/security/cve/CVE-2026-25680
- https://www.suse.com/security/cve/CVE-2026-25681
- https://www.suse.com/security/cve/CVE-2026-27136
- https://www.suse.com/security/cve/CVE-2026-33186
- https://www.suse.com/security/cve/CVE-2026-33814
- https://www.suse.com/security/cve/CVE-2026-39821
- https://www.suse.com/security/cve/CVE-2026-42502
- https://www.suse.com/security/cve/CVE-2026-42506
- https://www.suse.com/support/update/announcement/2026/suse-su-202622066-1/