Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-39832 EUVD-2026-31390GHSA-f5wc-c3c7-36mcGO-2026-5006

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Published May 22, 2026 · Updated Sep 15, 2026 · Assigned by Go

Vendor: golang.org/x/crypto Product: golang.org/x/crypto/ssh/agent Package: aactl Package: act Package: apko Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-events Package: argocd-image-updater Package: buildah Package: buildah Package: caddy Package: cert-manager-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: chezmoi Package: cilium-1.19 Package: cilium-cli Package: cloud-provider-aws-1.31-cloud-controller-manager Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: coredns-1.13 Package: cri-o Package: dagger Package: datadog-agent-7.78 Package: dkron Package: docker-buildx Package: docker-cli-buildx Package: docker-compose Package: docker-machine-driver-harvester Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: falco-no-driver Package: flux-2.8 Package: flux-image-automation-controller Package: flux-source-controller Package: fscrypt Package: gitaly-18.10 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-18.9 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitaly-backup-18.9 Package: gitea Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.8 Package: gitlab-agent-18.9 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-kas-18.9 Package: gitlab-pages-18.7 Package: gitlab-pages-18.8 Package: gitlab-pages-18.9 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-19.0 Package: gitsign Package: go-discover Package: golang-go.crypto Package: golang-go.crypto Package: golang.org/x/crypto Package: gomplate-5 Package: gptscript Package: grype Package: guac Package: guacingest Package: guacone Package: helm-3 Package: k3s Package: k3s-1.34 Package: k3s-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k9s Package: kaf Package: kaniko Package: kine Package: kots Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubescape Package: kuma-coredns-1.13 Package: kyverno-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.18 Package: kyverno-reports-controller-1.18 Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: lxd Package: mattermost-11.1 Package: melange Package: minio Package: nerdctl Package: nfpm Package: nuclei Package: openbao Package: opentelemetry-collector Package: opentofu-1.11 Package: osv-scanner Package: packer Package: podman Package: podman Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-config-reloader Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: scorecard Package: skaffold Package: snapd Package: snyk-cli Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: step Package: step-issuer Package: step-kms-plugin Package: syft Package: telegraf Package: telegraf-1.38 Package: teleport-18.6 Package: terragrunt Package: trivy Package: trivy-operator Package: witness Package: wolfictl Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Affected products

VendorProductAffectedFixed
golang.org/x/crypto golang.org/x/crypto/ssh/agent < 0.52.0 0.52.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-go.crypto 1:0.52.0-1 —
Debian 13 golang-go.crypto No fix yet —
Debian 12 golang-go.crypto No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 snapd No fix yet —
Ubuntu 26.04 LTS snapd No fix yet —
Ubuntu 25.10 snapd +1 No fix yet —
Ubuntu 24.04 LTS snapd No fix yet —
Ubuntu 22.04 LTS snapd No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-go.crypto 1:0.47.0-1ubuntu0.1~esm1 —
Ubuntu Pro 24.04 LTS golang-go.crypto 1:0.19.0-1ubuntu0.1~esm2 —
Ubuntu Pro 22.04 LTS golang-go.crypto 1:0.0~git20211202.5770296-1ubuntu0.1~esm2 —
Ubuntu Pro 20.04 LTS golang-go.crypto 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2 —
Ubuntu Pro 20.04 LTS snapd No fix yet —
Ubuntu Pro 18.04 LTS lxd +1 No fix yet —
Ubuntu Pro 16.04 LTS lxd +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 buildah +1 2:1.43.1-3.el10_2 RHSA-2026:36199
RHEL 10 podman +3 7:5.8.2-4.el10_2 RHSA-2026:37072
RHEL 9 buildah +1 2:1.43.1-3.el9_8 RHSA-2026:37410
RHEL 9 podman +4 6:5.8.2-4.el9_8 RHSA-2026:37123
RHEL 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 buildah +1 2:1.33.14-4.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 cockpit-podman 84.1-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 conmon 3:2.1.10-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 container-selinux 2:2.229.0-3.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 containernetworking-plugins 1:1.4.0-8.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 containers-common 2:1-82.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 crit +4 3.18-5.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 crun 1.14.3-2.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 fuse-overlayfs 1.13-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 libslirp +1 4.4.0-2.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 netavark 2:1.10.3-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 podman +6 4:4.9.4-32.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 python-podman +1 4.9.0-3.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 runc 4:1.2.9-4.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 skopeo +1 2:1.14.6-2.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 slirp4netns 1.2.3-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 toolbox +1 0.0.99.5.1-1.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
RHEL 8 udica 0.2.6-21.module+el8.10.0+24482+e50f4e4f RHSA-2026:35833
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS podman +4 5:5.4.0-22.el9_6.5 RHSA-2026:67450
RHEL 8.8 TUS aardvark-dns 2:1.5.0-2.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS buildah +1 1:1.29.8-1.module+el8.8.0+24545+b713e821 RHSA-2026:49944
RHEL 8.8 TUS cockpit-podman 63.1-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS conmon 3:2.1.6-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS container-selinux 2:2.229.0-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS containernetworking-plugins 1:1.2.0-3.module+el8.8.0+24525+a924b82f.1 RHSA-2026:49944
RHEL 8.8 TUS containers-common 2:1-67.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS crit +4 3.15-4.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS crun 1.14.3-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS fuse-overlayfs 1.11-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS libslirp +1 4.4.0-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS netavark 2:1.5.1-3.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS oci-seccomp-bpf-hook 1.2.10-1.module+el8.8.0+24130+2fde7a57 RHSA-2026:49944
RHEL 8.8 TUS podman +6 3:4.4.1-27.module+el8.8.0+24545+b713e821.8 RHSA-2026:49944
RHEL 8.8 TUS python-podman +1 4.4.1-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS runc 1:1.2.9-1.module+el8.8.0+24525+a924b82f.1 RHSA-2026:49944
RHEL 8.8 TUS skopeo +1 2:1.11.6-1.module+el8.8.0+24525+a924b82f RHSA-2026:49944
RHEL 8.8 TUS slirp4netns 1.2.0-3.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS toolbox +1 0.0.99.3-7.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 TUS udica 0.2.6-20.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S aardvark-dns 2:1.5.0-2.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S buildah +1 1:1.29.8-1.module+el8.8.0+24545+b713e821 RHSA-2026:49944
RHEL 8.8 E4S cockpit-podman 63.1-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S conmon 3:2.1.6-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S container-selinux 2:2.229.0-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S containernetworking-plugins 1:1.2.0-3.module+el8.8.0+24525+a924b82f.1 RHSA-2026:49944
RHEL 8.8 E4S containers-common 2:1-67.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S crit +4 3.15-4.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S crun 1.14.3-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S fuse-overlayfs 1.11-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S libslirp +1 4.4.0-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S netavark 2:1.5.1-3.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S oci-seccomp-bpf-hook 1.2.10-1.module+el8.8.0+24130+2fde7a57 RHSA-2026:49944
RHEL 8.8 E4S podman +6 3:4.4.1-27.module+el8.8.0+24545+b713e821.8 RHSA-2026:49944
RHEL 8.8 E4S python-podman +1 4.4.1-1.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S runc 1:1.2.9-1.module+el8.8.0+24525+a924b82f.1 RHSA-2026:49944
RHEL 8.8 E4S skopeo +1 2:1.11.6-1.module+el8.8.0+24525+a924b82f RHSA-2026:49944
RHEL 8.8 E4S slirp4netns 1.2.0-3.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S toolbox +1 0.0.99.3-7.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
RHEL 8.8 E4S udica 0.2.6-20.module+el8.8.0+23884+2031fc78 RHSA-2026:49944
Red Hat Edge Manager 1 flightctl +3 1.0.3-1.el9em RHSA-2026:41019, RHSA-2026:36796

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 buildah +1 2:1.43.1-3.el10_2 ALSA-2026:36199
AlmaLinux 9 buildah +1 2:1.43.1-3.el9_8 ALSA-2026:37410
AlmaLinux 9 podman +4 6:5.8.2-4.el9_8 ALSA-2026:37123
AlmaLinux 8 aardvark-dns 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 ALSA-2026:35833
AlmaLinux 8 buildah +1 2:1.33.14-4.module_el8.10.0+4213+0493256b ALSA-2026:35833
AlmaLinux 8 cockpit-podman 84.1-1.module_el8.10.0+4102+6c76e544 ALSA-2026:35833
AlmaLinux 8 conmon 3:2.1.10-1.module_el8.10.0+3970+8445edf6 ALSA-2026:35833
AlmaLinux 8 container-selinux 2:2.229.0-3.module_el8.10.0+4213+0493256b ALSA-2026:35833
AlmaLinux 8 containernetworking-plugins 1:1.4.0-8.module_el8.10.0+4136+16425343 ALSA-2026:35833
AlmaLinux 8 containers-common 2:1-82.module_el8.10.0+3876+e55593a8 ALSA-2026:35833
AlmaLinux 8 crit 3.18-5.module_el8.10.0+3845+87b84552 ALSA-2026:35833
AlmaLinux 8 criu +1 3.18-5.module_el8.10.0+3876+e55593a8 ALSA-2026:35833
AlmaLinux 8 criu-devel 3.18-5.module_el8.10.0+3858+6ad51f9f ALSA-2026:35833
AlmaLinux 8 criu-libs 3.18-5.module_el8.10.0+3909+6e1c1eb7 ALSA-2026:35833
AlmaLinux 8 crun 1.14.3-2.module_el8.10.0+4082+f7f0c95e ALSA-2026:35833
AlmaLinux 8 fuse-overlayfs 1.13-1.module_el8.10.0+3792+03eaed9c ALSA-2026:35833
AlmaLinux 8 libslirp 4.4.0-2.module_el8.10.0+4023+db236c53 ALSA-2026:35833
AlmaLinux 8 libslirp-devel 4.4.0-2.module_el8.10.0+3970+8445edf6 ALSA-2026:35833
AlmaLinux 8 netavark 2:1.10.3-1.module_el8.10.0+3970+8445edf6 ALSA-2026:35833
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 ALSA-2026:35833
AlmaLinux 8 podman +6 4:4.9.4-32.module_el8.10.0+4213+0493256b ALSA-2026:35833
AlmaLinux 8 python3-podman 4.9.0-3.module_el8.10.0+4016+efd18bf8 ALSA-2026:35833
AlmaLinux 8 runc 4:1.2.9-4.module_el8.10.0+4136+16425343 ALSA-2026:35833
AlmaLinux 8 skopeo +1 2:1.14.6-2.module_el8.10.0+4211+49ea0979 ALSA-2026:35833
AlmaLinux 8 slirp4netns 1.2.3-1.module_el8.10.0+3926+f12484f5 ALSA-2026:35833
AlmaLinux 8 toolbox +1 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47 ALSA-2026:35833
AlmaLinux 8 udica 0.2.6-21.module_el8.10.0+4068+0e21408f ALSA-2026:35833

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 buildah 2:1.43.1-3.el10_2 RLSA-2026:36199
Rocky Linux 10 podman 7:5.8.2-4.el10_2 RLSA-2026:37072
Rocky Linux 9 buildah 2:1.43.1-3.el9_8 RLSA-2026:37410
Rocky Linux 9 podman 6:5.8.2-4.el9_8 RLSA-2026:37123
Rocky Linux 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1874+ce489889 RLSA-2026:35833
Rocky Linux 8 cockpit-podman 84.1-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 conmon 3:2.1.10-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 container-selinux 2:2.229.0-3.module+el8.10.0+40223+e940a224 RLSA-2026:35833
Rocky Linux 8 containernetworking-plugins 1:1.4.0-8.module+el8.10.0+40133+32c21f88 RLSA-2026:35833
Rocky Linux 8 containers-common 2:1-82.module+el8.10.0+1843+6892ab28 RLSA-2026:35833
Rocky Linux 8 criu 3.18-5.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 crun 1.14.3-2.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 fuse-overlayfs 1.13-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 libslirp 4.4.0-2.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 netavark 2:1.10.3-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 python-podman 4.9.0-3.module+el8.10.0+1896+b18fa106 RLSA-2026:35833
Rocky Linux 8 runc 4:1.2.9-4.module+el8.10.0+40133+32c21f88 RLSA-2026:35833
Rocky Linux 8 skopeo 2:1.14.6-2.module+el8.10.0+40223+e940a224 RLSA-2026:35833
Rocky Linux 8 slirp4netns 1.2.3-1.module+el8.10.0+1815+5fe7415e RLSA-2026:35833
Rocky Linux 8 toolbox 0.0.99.5.1-1.module+el8.10.0+40087+cfe9c127.rocky.0.2 RLSA-2026:35833
Rocky Linux 8 udica 0.2.6-21.module+el8.10.0+1815+5fe7415e RLSA-2026:35833

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.17.1-150700.15.23.1 SUSE-SU-2026:2824-1
SLES 15 SP7 amazon-ssm-agent 3.3.4624.0-150000.5.37.1 SUSE-SU-2026:2467-1
SLES 15 SP7 apptainer 1.5.1-150600.4.24.1 SUSE-SU-2026:2609-1
SLES 15 SP7 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP7 containerized-data-importer 1.64.0-150700.9.14.1 SUSE-SU-2026:4209-1
SLES 15 SP7 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP7 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES 15 SP7 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLES 15 SP7 google-osconfig-agent 20260615.01-150000.1.55.1 SUSE-SU-2026:2611-1
SLES 15 SP7 kubevirt 1.7.4-150700.3.30.1 SUSE-SU-2026:3203-1
SLES 15 SP6 amazon-ssm-agent 3.3.4624.0-150000.5.37.1 SUSE-SU-2026:2467-1
SLES 15 SP6 apptainer 1.5.1-150600.4.24.1 SUSE-SU-2026:2609-1
SLES 15 SP6 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP6 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP6 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES 15 SP6 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLES 15 SP6 google-osconfig-agent 20260615.01-150000.1.55.1 SUSE-SU-2026:2611-1
SLES 15 SP5 amazon-ssm-agent 3.3.4624.0-150000.5.37.1 SUSE-SU-2026:2467-1
SLES 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP5 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES 15 SP5 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLES 15 SP5 google-osconfig-agent 20260615.01-150000.1.55.1 SUSE-SU-2026:2611-1
SLES 15 SP5 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 amazon-ssm-agent 3.3.4624.0-150000.5.37.1 SUSE-SU-2026:2467-1
SLES 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLES 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP4 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES 15 SP4 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLES 15 SP4 google-osconfig-agent 20260615.01-150000.1.55.1 SUSE-SU-2026:2611-1
SLES 15 SP4 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
SLES 12 amazon-ssm-agent 3.3.4624.0-4.49.1 SUSE-SU-2026:2468-1
SLES 12 google-guest-agent 20260529.00-1.61.1 SUSE-SU-2026:2581-1
SLES 12 google-osconfig-agent 20260615.01-1.47.1 SUSE-SU-2026:2665-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
SLES for SAP 16.0 amazon-ssm-agent 3.3.4624.0-160000.1.1 SUSE-SU-2026:22157-1
SLES for SAP 16.0 cosign +1 3.1.1-160000.1.1 SUSE-SU-2026:22613-1, SUSE-SU-2026:22159-1
SLES for SAP 16.0 google-guest-agent 20260529.00-160000.1.1 SUSE-SU-2026:22376-1
SLES for SAP 16.0 google-osconfig-agent 20260615.01-160000.1.2 SUSE-SU-2026:22558-1
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES for SAP 16.0 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22193-1
SLES for SAP 15 SP6 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES for SAP 15 SP6 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES for SAP 15 SP6 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES for SAP 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES for SAP 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES for SAP 15 SP5 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES for SAP 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLES for SAP 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES for SAP 15 SP4 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLES 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
SLES 16.0 amazon-ssm-agent 3.3.4624.0-160000.1.1 SUSE-SU-2026:22157-1
SLES 16.0 cosign +1 3.1.1-160000.1.1 SUSE-SU-2026:22613-1, SUSE-SU-2026:22159-1
SLES 16.0 google-guest-agent 20260529.00-160000.1.1 SUSE-SU-2026:22376-1
SLES 16.0 google-osconfig-agent 20260615.01-160000.1.2 SUSE-SU-2026:22558-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22193-1
SLE Micro 6.2 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22226-1
SLE Micro 6.1 elemental-toolkit 2.2.9-slfo.1.1_1.1 SUSE-SU-2026:22074-1
SLE Micro 6.1 google-guest-agent 20260529.00-slfo.1.1_1.1 SUSE-SU-2026:22442-1
SLE Micro 6.1 google-osconfig-agent 20260615.01-slfo.1.1_1.1 SUSE-SU-2026:22249-1
SLE Micro 6.1 podman 5.4.2-slfo.1.1_5.1 SUSE-SU-2026:22451-1
SLE Micro 6.0 elemental-toolkit 2.1.6-1.1 SUSE-SU-2026:22065-1
SLE Micro 6.0 google-guest-agent 20260529.00-1.1 SUSE-SU-2026:22423-1
SLE Micro 6.0 google-osconfig-agent 20260615.01-1.1 SUSE-SU-2026:22242-1
SLE Micro 6.0 podman 4.9.5-12.1 SUSE-SU-2026:22516-1
SLE Micro 5.5 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLE Micro 5.5 google-osconfig-agent 20260615.01-150000.1.55.1 SUSE-SU-2026:2611-1
SLE HPC 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLE HPC 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLE HPC 15 SP5 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1
SLE HPC 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLE HPC 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLE HPC 15 SP4 distribution 3.1.1-150400.9.41.1 SUSE-SU-2026:4212-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.4.5-5.1 openSUSE-SU-2026:10842-1
openSUSE Tumbleweed containerized-data-importer1.65 1.65.0-2.1 openSUSE-SU-2026:11305-1
openSUSE Tumbleweed containerized-data-importer1.66 1.66.0-1.1 openSUSE-SU-2026:11514-1
openSUSE Tumbleweed git-bug 0.10.1-5.1 openSUSE-SU-2026:10949-1
openSUSE Tumbleweed kit 0.107.0-1.1 openSUSE-SU-2026:11806-1
openSUSE Tumbleweed kubevirt1.8 1.8.4-2.1 openSUSE-SU-2026:11314-1
openSUSE Tumbleweed kubevirt1.9 1.9.0-1.1 openSUSE-SU-2026:11520-1
openSUSE Tumbleweed mcphost 0.34.0-5.1 openSUSE-SU-2026:10845-1
openSUSE Tumbleweed rclone 1.74.2-1.1 openSUSE-SU-2026:10856-1
openSUSE Tumbleweed velociraptor 0.7.0.4.git185.a5708584-2.1 openSUSE-SU-2026:11126-1
openSUSE Leap 16.0 alloy 1.17.0-160000.1.1 openSUSE-SU-2026:21251-1
openSUSE Leap 16.0 amazon-ssm-agent 3.3.4624.0-160000.1.1 openSUSE-SU-2026:21079-1
openSUSE Leap 16.0 cloudflared 2026.9.1-bp160.1.1 openSUSE-SU-2026:21924-1
openSUSE Leap 16.0 containerized-data-importer1.65 1.65.0-160000.3.1 openSUSE-SU-2026:21824-1
openSUSE Leap 16.0 cosign +1 3.1.1-160000.1.1 openSUSE-SU-2026:21281-1, openSUSE-SU-2026:21084-1
openSUSE Leap 16.0 glab 1.114.0-bp160.1.1 openSUSE-SU-2026:21662-1
openSUSE Leap 16.0 google-guest-agent 20260529.00-160000.1.1 openSUSE-SU-2026:21069-1
openSUSE Leap 16.0 google-osconfig-agent 20260615.01-160000.1.2 openSUSE-SU-2026:21210-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21761-1, openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 kubevirt1.8 1.8.4-160000.1.1 openSUSE-SU-2026:21590-1
openSUSE Leap 16.0 mcphost 0.34.0-160000.2.1 openSUSE-SU-2026:21120-1
openSUSE Leap 16.0 podman 5.4.2-160000.5.1 openSUSE-SU-2026:21244-1
openSUSE Leap 16.0 rclone 1.74.4-bp160.1.1 openSUSE-SU-2026:21436-1
openSUSE Leap 16.0 trivy 0.71.0-160000.1.1 openSUSE-SU-2026:20956-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300069.1-1.amzn2023 ALAS2023-2026-2025
Amazon Linux 2023 containerd +1 2.2.4-1.amzn2023.0.1 ALAS2023-2026-1784
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.3 ALAS2023-2026-1788
Amazon Linux 2023 rclone 1.74.2-80.amzn2023 ALAS2023-2026-1810
Amazon Linux 2023 runfinch-finch 1.17.1-1.amzn2023.0.2 ALAS2023-2026-1809
Amazon Linux 2 amazon-cloudwatch-agent 1.300069.1-1.amzn2 ALAS2-2026-3844
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.3 ALAS2-2026-3334

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cri-o +2 No fix yet —
Azure Linux 3 docker-buildx 0.14.0-13 —
Azure Linux 3 docker-compose 2.27.0-11 —
Azure Linux 3 packer 1.9.5-15 —
Azure Linux 3 telegraf 1.31.0-22 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 buildah +1 2:1.43.1-4.0.1.el10_2 ELSA-2026-36199
Oracle Linux 10 podman +3 7:5.8.2-5.0.1.el10_2 ELSA-2026-37072
Oracle Linux 9 buildah +1 2:1.43.1-3.0.1.el9_8 ELSA-2026-37410
Oracle Linux 9 podman +4 6:5.8.2-4.0.1.el9_8 ELSA-2026-37123
Oracle Linux 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 buildah +1 2:1.33.14-4.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 cockpit-podman 84.1-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 conmon 3:2.1.10-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 container-selinux 2:2.229.0-3.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 containernetworking-plugins 1:1.4.0-8.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 containers-common 2:1-82.0.1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 crit +4 3.18-5.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 crun 1.14.3-2.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 fuse-overlayfs 1.13-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 libslirp +1 4.4.0-2.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 netavark 2:1.10.3-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 podman +6 4:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 python3-podman 4.9.0-3.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 runc 4:1.2.9-4.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 skopeo +1 2:1.14.6-2.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 slirp4netns 1.2.3-1.module+el8.10.0+90948+3b47585b ELSA-2026-35833
Oracle Linux 8 udica 0.2.6-21.module+el8.10.0+90948+3b47585b ELSA-2026-35833

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r53 —
Wolfi rolling act 0.2.88-r6 —
Wolfi rolling apko 1.2.14-r2 —
Wolfi rolling argo-cd-3.3-compat 3.3.14-r9 —
Wolfi rolling argo-cd-3.4 +1 3.4.2-r4 —
Wolfi rolling argo-events 1.9.10-r24 —
Wolfi rolling argocd-image-updater 1.2.1-r2 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling caddy 2.11.3-r2 —
Wolfi rolling cert-manager-1.20 +4 1.20.2-r7 —
Wolfi rolling chezmoi 2.70.4-r2 —
Wolfi rolling cilium-1.19 1.19.4-r2 —
Wolfi rolling cilium-cli 0.19.4-r0 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r16 —
Wolfi rolling containerd-1 1.7.32-r2 —
Wolfi rolling containerd-2 +1 2.3.1-r1 —
Wolfi rolling dagger 0.20.8-r7 —
Wolfi rolling datadog-agent-7.78 7.78.4-r2 —
Wolfi rolling dkron 4.1.1-r2 —
Wolfi rolling docker-cli-buildx 0.34.1-r3 —
Wolfi rolling docker-machine-driver-harvester 1.0.6-r11 —
Wolfi rolling external-dns-0.21 0.21.0-r7 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r10 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r7 —
Wolfi rolling external-secrets-operator-2.5 2.5.0-r3 —
Wolfi rolling falco-no-driver 0.44.1-r6 —
Wolfi rolling flux-2.8 2.8.8-r2 —
Wolfi rolling flux-image-automation-controller 1.1.4-r3 —
Wolfi rolling flux-source-controller 1.8.5-r2 —
Wolfi rolling fscrypt 0.3.6-r9 —
Wolfi rolling gitaly-18.10 18.10.7-r1 —
Wolfi rolling gitaly-18.7 +25 No fix yet —
Wolfi rolling gitea 1.26.2-r2 —
Wolfi rolling gitlab-kas-18.6 +1 18.6.8-r1 —
Wolfi rolling gitlab-runner-18.10 +1 18.10.1-r11 —
Wolfi rolling gitlab-runner-18.11 +1 18.11.3-r4 —
Wolfi rolling gitlab-runner-19.0 +1 19.0.0-r1 —
Wolfi rolling gitsign 0.16.0-r5 —
Wolfi rolling go-discover 0_git20260522-r2 —
Wolfi rolling gomplate-5 5.1.0-r6 —
Wolfi rolling gptscript 0.9.9-r243 —
Wolfi rolling grype 0.112.0-r6 —
Wolfi rolling guac +2 1.1.0-r15 —
Wolfi rolling helm-3 3.21.0-r3 —
Wolfi rolling k3s +1 1.36.1.1-r0 —
Wolfi rolling k3s-1.34 +1 1.34.6.1-r11 —
Wolfi rolling k3s-1.35 +1 1.35.5.1-r0 —
Wolfi rolling k3s-static-1.32 1.32.13.1-r19 —
Wolfi rolling k9s 0.50.18-r28 —
Wolfi rolling kaf 0.2.14-r5 —
Wolfi rolling kaniko 1.25.15-r4 —
Wolfi rolling kine 0.16.0-r1 —
Wolfi rolling kots 1.130.4-r4 —
Wolfi rolling kubeadm-1.34 +6 1.34.8-r1 —
Wolfi rolling kubeadm-1.35 +6 1.35.5-r1 —
Wolfi rolling kubeadm-1.36 +6 1.36.1-r1 —
Wolfi rolling kubectl-bash-completion-1.35 +3 1.35.8-r6 —
Wolfi rolling kubernetes-dashboard 7.14.0-r8 —
Wolfi rolling kubescape 4.0.8-r6 —
Wolfi rolling kyverno-1.17 +1 1.17.2-r35 —
Wolfi rolling kyverno-cli-1.18 +4 1.18.1-r3 —
Wolfi rolling loki-3.6 +3 3.6.11-r1 —
Wolfi rolling loki-3.7 +2 3.7.2-r2 —
Wolfi rolling mattermost-11.1 11.1.3-r3 —
Wolfi rolling melange 0.50.8-r2 —
Wolfi rolling minio 0.20260520.234452-r2 —
Wolfi rolling nerdctl 2.3.1-r3 —
Wolfi rolling nfpm 2.46.3-r6 —
Wolfi rolling nuclei 3.8.0-r9 —
Wolfi rolling openbao 2.5.4-r1 —
Wolfi rolling opentelemetry-collector 0.152.1-r2 —
Wolfi rolling opentofu-1.11 1.11.8-r2 —
Wolfi rolling osv-scanner 2.3.8-r5 —
Wolfi rolling podman 5.8.2-r5 —
Wolfi rolling prometheus-3.10 3.10.0-r23 —
Wolfi rolling prometheus-3.11 3.11.3-r17 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-3.9 3.9.1-r7 —
Wolfi rolling prometheus-config-reloader 0.91.0-r3 —
Wolfi rolling pulumi +3 3.243.0-r1 —
Wolfi rolling pulumi-kubernetes-operator 2.7.0-r8 —
Wolfi rolling pulumi-language-dotnet 3.106.2-r4 —
Wolfi rolling pulumi-language-java 1.28.0-r2 —
Wolfi rolling pulumi-language-yaml 1.35.0-r2 —
Wolfi rolling rancher-2.13 2.13.6-r1 —
Wolfi rolling rancher-2.14 2.14.1-r3 —
Wolfi rolling rancher-agent-2.13 2.13.9-r4 —
Wolfi rolling scorecard 5.5.0-r7 —
Wolfi rolling skaffold 2.21.0-r3 —
Wolfi rolling snyk-cli 1.1304.3-r4 —
Wolfi rolling spire-agent +2 1.15.0-r2 —
Wolfi rolling step 0.30.2-r9 —
Wolfi rolling step-issuer 0.10.2-r14 —
Wolfi rolling step-kms-plugin 0.17.0-r4 —
Wolfi rolling syft 1.44.0-r7 —
Wolfi rolling telegraf-1.38 1.38.4-r4 —
Wolfi rolling teleport-18.6 18.6.8-r16 —
Wolfi rolling terragrunt 1.0.5-r2 —
Wolfi rolling trivy 0.70.0-r3 —
Wolfi rolling trivy-operator 0.30.1-r13 —
Wolfi rolling witness 0.11.0-r6 —
Wolfi rolling wolfictl 0.39.17-r2 —
Wolfi rolling zarf 0.77.0-r0 —
Wolfi rolling zot 2.1.17-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/crypto < 0.52.0 0.52.0 GHSA-f5wc-c3c7-36mc

Advisories 50

References