🛡️ SUSE-SU-2026:22141-1 — elemental-system-agent (CVE-2026-33186)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for elemental-system-agent

This update for elemental-system-agent fixes the following issue

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-

header (bsc#1260277).

Changes for elemental-system-agent:

  • Update to version 0.3.16:
  • setup for immutable releases (#274)
  • align system-agent image publishing for signed releases (#270)
  • Bumo github.com/docker/cli to v29.2.0 and go.opentelemetry.io/otel to v1.43.0
  • run go mod tidy in /test folder
  • Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (bsc#1260277 CVE-2026-33186)
  • Bump github.com/docker/cli in /test
  • export CATTLE_NODE_NAME if SYSTEM_UPGRADE_NODE_NAME is set
  • use correct prefix for system-agent binary (#273)
  • checksum validation (#271)
  • Add validate subcommand for configuration validation (#250)
  • Update CODEOWNERS
  • Pin GH Actions to commit sha
  • chore: bump sles to 15.7
  • Extend remote plan e2e tests
  • Fix agent restart issue and introduce constants
  • chore: bump go to v1.25
  • Setup e2e test infrastructure
  • chores(deps): Bump k8s dependencies
  • Define linter rules
  • Fix CI failures
  • Introduce an extended Makefile
  • Switch workflows to use name makefile
  • Replace dapper with multi stage builds
  • Remove dapper scripts
  • Add multiple improvements for ignore files
  • fix: remove umask command from the system-agent unit-file
  • fix-system-agent-umask
  • [1.34] bumped dependencies for 1.34 support (#242)
  • Bump K8s patch level to 1.33.5 and Go patch level to 1.24.6
  • fix: properly handle traps after unsuccessful SUC job execution
  • fix: do not unconditionally reset failure-counts
  • fix: remove resetFailureCountOnStartup, always reset failure counts on first start
  • un-rc wrangler and lasso
  • drop windows 2019 when running PR CI
  • Update to version 0.3.13:
  • Bumped dependencies for k8s v1.33
  • Add delete for plan.File
  • fix dispatch
  • fix: add retry logic for one time instruction
  • Get UID/GID for current user in write file_test.go
  • Update secrets for dispatch
  • fix golangci
  • support k8s 1.32.2
  • Add GitHub App token generation and dispatch job for System Agent Upgrade workflow.
  • Add ResetFailureCountOnServiceRestart, if true reset plan failure count after each restart of the system-agent
  • Bump wharfie to v0.6.7
  • Add tests and update CI
  • Windows updates

Affected software

SUSE-SU-2026:22141-1 is recorded against 1 package.

  • elemental-system-agent (fixed in 0.3.16-slfo.1.1_1.1)

Timeline and source

Published on 11 June 2026 and last revised on 18 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.suse.com (Advisory)
bugzilla.suse.com (Report)
www.suse.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-06-11
Updated 2026-08-20
Modified 2026-06-18
Fix URL N/A

Affected Packages

Software From version Fixed in
elemental-system-agent 0.3.16-slfo.1.1_1.1

Similar Threats

Free Vulnerability Check

Is your site affected by SUSE-SU-2026:22141-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against SUSE-SU-2026:22141-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesSUSESUSE 2026