Threat database

These are all security issues fixed in the valkey-9.1.2-3.1 package on the GA media of openSUSE Tumbleweed.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This security update provides a functional equivalent of RHSA-2026:73979. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:73979.

A vulnerability in the Linux kernel's soft-iWARP implementation allows a malicious connected siw peer to send a malformed iWARP FPDU with an underflow in the MPA length field. This causes a signed integer underflow leading to a large unsigned read in kernel memory copy operations. The issue is addressed by adding a check to reject malformed FPDUs that violate protocol length constraints, terminating the connection on error.

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458). - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape) (bsc#1273232). - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom) (bsc#1274074). - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).

This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read (bsc#1280619).

A high severity vulnerability exists in libsoup's WebSocket handling where the ::pong signal emits a GByteArray pointer instead of the expected GBytes, causing type confusion. This flaw can lead to heap corruption or crashes when applications connect handlers expecting GBytes and receive a crafted Pong frame. The vulnerability is remotely triggerable without authentication. Red Hat has released an important security update for Red Hat Enterprise Linux 9 addressing this and related heap buffer overflow issues in libsoup.

This update for perl-Protocol-HTTP2 fixes the following issue: - CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams never being removed by `stream_state` from the connection stream table (bsc#1279629).

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

CVE-2026-88805 is a high-severity vulnerability in SUSE Rancher versions 2.15.0 and 2.15.1 where insufficient session expiration occurs due to incorrect credential cleaning on logout. This flaw allows remote attackers to retain access credentials even after the user logs out, potentially leading to unauthorized access. The issue is fixed starting from version 2.15.2.

CVE-2026-88808 is a high-severity vulnerability in SUSE Rancher Fleet where the Fleet agent improperly uses cluster-admin credentials instead of the intended ServiceAccount credentials when writing resources to downstream clusters. This affects multi-tenant environments sharing downstream clusters, potentially allowing unauthorized overwriting of configuration files. The issue impacts SUSE Rancher Fleet versions 0.14 before 0.14.11, 0.15 before 0.15.7, and 0.16 before 0.16.2.

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for.  This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.

CVE-2026-78424 is an OS command injection vulnerability in SUSE NeuVector affecting versions before 5.4.11, 5.5.4, and 5.6.2. It allows authenticated users with specific write permissions or access to internal gRPC certificate keys to execute arbitrary OS commands in a privileged container, potentially compromising the entire worker node. The vulnerability has a high severity with a CVSS score of 8.8.

A high severity security update has been issued for PostgreSQL by the SUSE Product Security Team addressing multiple vulnerabilities including CVE-2026-14662. This update corresponds functionally to Red Hat's advisory RHSA-2026:69924. The vulnerabilities relate to integer overflow issues (CWE-190) and affect various SUSE PostgreSQL versions. A patch is available to remediate these issues.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.