Skip to main content
CVE-2025-22868VulnerabilityPublished Updated

SUSE · Security update for google-guest-agent

Affects SUSESource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch SUSE soon.

Data as of 10 Nov 2026, 20:06 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 20260430.00

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 15 Jun 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for google-guest-agent fixes the following issues: Changes in google-guest-agent: Update to version 20260430.00 * Update OWNERS (#609) * Update THIRD_PARTY_LICENSES to be package specific location. (#608) * Update dependencies and go version to 1.26.2 (#607) (bsc#1265762, CVE-2026-33814) * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604) (bsc#1260264, CVE-2026-33186) * Backport oslogin changes for sles16 to legacy agent (#603) * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596) * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) * Actually finally fix the RPM spec (#601) * Correct guest telemetry build target (#600) * Add packaging for new telemetry extension (#599) * Implement new scheduled job for routes monitor (#598) * Add packaging changes for locally bundled extensions feature support (#593) * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591) * Disable certificates when security keys are enabled (#588) * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590) * Source the contents of /var/google-users.d config files. (#586) * Force remove core plugin configuration for windows (#587) * network: force address manager to always consolidate the OS state (#585) * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583) (bsc#1239334, CVE-2025-22869, bsc#1253889, CVE-2025-58181) * Don't delete the authorized_keys file when an empty key list is passed to updateAuthorizedKeysFile (#582) * Add Tyler, Saswat, Hank to OWNERS (#577) * Honor core plugin setting on windows package update (#576) * Restart agent if core plugin is disabled (#575) * Add extra debug logging around toggling OS Login (#572) * Update go version to 1.25 (#565) * Add compat adapt script to windows in agent sysprep (#569) * Fix adapt to use more portable shebang line (#567) * Remove routes script from packaging (#566) * Update adapt script to run on startup/shutdown both (#561) * Update agent_uninstall.ps1 (#558) * Stop core plugin before removing agent package (#554) * Startup scripts should start after agent manager instead (#553) * Update presets and install dependencies on systemd units (#552) * Ensure agent service is disabled (#551) * Disable legacy agent to enable core plugin (#550) * Final fix for RHEL packaging for routes setup (#549) * Fix RHEL packaging for routes scripts (#548) * Packaging changes to include routes script installation (#542) * Update CLI name in packaging (#543) * systemd should manage only the main process (#544) - from version 20260424.00 * Bring topic-stable up to latest point. (#606) * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592) * fix start mode for windows on stable release (#584) * Update agent_uninstall.ps1 (#558) (#580) * Update go version for stable branch to 1.25 (#571) * Add adapt script in stable branch as per #569 (#570) * Backport fix from #567 to stable branch (#568) * Revert compat behavior and call known binary directly (#560) * Revert compat behavior and call known binary directly (#559) * Build rollforward package to re-enable original agent and disable core plugin (#557) - from version 20260423.01 * Update THIRD_PARTY_LICENSES to be package specific location. (#608) - from version 20260423.00 * Update dependencies and go version to 1.26.2 (#607) * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604) * Backport oslogin changes for sles16 to legacy agent (#603) * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596) * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) * Actually finally fix the RPM spec (#601) * Correct guest telemetry build target (#600) * Add packaging for new telemetry extension (#599) * Implement new scheduled job for routes monitor (#598) * Add packaging changes for locally bundled extensions feature support (#593) * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591) * Disable certificates when security keys are enabled (#588) * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590) * Source the contents of /var/google-users.d config files. (#586) * Force remove core plugin configuration for windows (#587) * network: force address manager to always consolidate the OS state (#585) * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583) * Don't delete the authorized_keys file when an empty key list is passed to updateAuthorizedKeysFile (#582) * Add Tyler, Saswat, Hank to OWNERS (#577) * Honor core plugin setting on windows package update (#576) * Restart agent if core plugin is disabled (#575) * Add extra debug logging around toggling OS Login (#572) * Update go version to 1.25 (#565) * Add compat adapt script to windows in agent sysprep (#569) * Fix adapt to use more portable shebang line

References

Community reviews

Loading reviews…