Security updates¶
This page lists the fixed CVEs for this release.
List of fixed CVEs¶
The following table lists the Common Vulnerabilities and Exposures (CVE) fixes included in this release.
| CVE number | Bug IDs | Image names | Package name |
|---|---|---|---|
CVE-2023-48795 |
2315017 | otel-config-builder | golang.org/x/crypto |
CVE-2024-27304 |
2315009 | otel-config-builder | github.com/jackc/pgx/v5 |
CVE-2024-45337 |
2315001 | otel-config-builder | golang.org/x/crypto |
CVE-2025-1352 |
2315997 | frontend | libelf1t64 |
CVE-2025-1376 |
2316001 | frontend | libelf1t64 |
CVE-2025-14017 |
2315477, 2315649 | curl, postgres | curl, libcurl |
CVE-2025-14524 |
2315497, 2315737 | curl, postgres | curl, libcurl |
CVE-2025-14819 |
2315501, 2315741 | curl, postgres | curl, libcurl |
CVE-2025-22869 |
2315013 | otel-config-builder | golang.org/x/crypto |
CVE-2025-29481 |
2316005 | frontend | libbpf1 |
CVE-2025-45582 |
2316057 | baseos | tar |
CVE-2025-47914 |
2315021 | otel-config-builder | golang.org/x/crypto |
CVE-2025-5222 |
2316009 | frontend | libicu74 |
CVE-2025-58181 |
2315025 | otel-config-builder | golang.org/x/crypto |
CVE-2025-59530 |
2314985 | provisioning | github.com/quic-go/quic-go |
CVE-2025-64702 |
2314989 | provisioning | github.com/quic-go/quic-go |
CVE-2026-10536 |
2369641 | curl | curl |
CVE-2026-11352 |
2369645 | curl | curl |
CVE-2026-11564 |
2369649 | curl | curl |
CVE-2026-11586 |
2369653 | curl | curl |
CVE-2026-11856 |
2369625 | curl | curl |
CVE-2026-12064 |
2369657 | curl | curl |
CVE-2026-1965 |
2315481, 2315701 | curl, postgres | curl, libcurl |
CVE-2026-2219 |
2316061 | baseos | dpkg |
CVE-2026-25679 |
2315053 | backend | stdlib |
CVE-2026-2673 |
2315457 | vault | libcrypto3 |
CVE-2026-27135 |
2315597 | postgres | nghttp2-libs |
CVE-2026-27139 |
2315137 | backend | stdlib |
CVE-2026-27142 |
2315113 | backend | stdlib |
CVE-2026-27145 |
2315145, 2315197, 2315369, 2315569, 2315829, 2316165 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-28387 |
2315429 | vault | libcrypto3 |
CVE-2026-28388 |
2315433 | vault | libcrypto3 |
CVE-2026-28389 |
2315437 | vault | libcrypto3 |
CVE-2026-28390 |
2315441 | vault | libcrypto3 |
CVE-2026-29181 |
2315057 | backend | go.opentelemetry.io/otel |
CVE-2026-31789 |
2315425 | vault | libcrypto3 |
CVE-2026-31790 |
2315461 | vault | libcrypto3 |
CVE-2026-32280 |
2315061 | backend | stdlib |
CVE-2026-32281 |
2315065 | backend | stdlib |
CVE-2026-32282 |
2315117 | backend | stdlib |
CVE-2026-32283 |
2315069 | backend | stdlib |
CVE-2026-32287 |
2315381 | otel-collector | github.com/antchfx/xpath |
CVE-2026-32288 |
2315121 | backend | stdlib |
CVE-2026-32289 |
2315125 | backend | stdlib |
CVE-2026-32952 |
2315045, 2315129, 2315465, 2315909 | backend, vault, vault-unsealer, zitadel | github.com/Azure/go-ntlmssp |
CVE-2026-33532 |
2315269 | zitadel-login | yaml |
CVE-2026-33671 |
2315213 | zitadel-login | picomatch |
CVE-2026-33672 |
2315273 | zitadel-login | picomatch |
CVE-2026-33750 |
2315277 | zitadel-login | brace-expansion |
CVE-2026-33811 |
2315077, 2315157, 2315329, 2315505, 2315765, 2316025 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-33814 |
2315161, 2315333, 2315509, 2315769, 2316029 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-33816 |
2314981, 2315005 | otel-config-builder, provisioning | github.com/jackc/pgx/v5 |
CVE-2026-33845 |
2316069 | baseos | libgnutls30t64 |
CVE-2026-33846 |
2316073 | baseos | libgnutls30t64 |
CVE-2026-33997 |
2315405 | otel-collector | github.com/docker/docker |
CVE-2026-34040 |
2315385 | otel-collector | github.com/docker/docker |
CVE-2026-34180 |
2369809 | clickhouse | libcrypto3 |
CVE-2026-34181 |
2369813 | clickhouse | libcrypto3 |
CVE-2026-34182 |
2369793 | clickhouse | libcrypto3 |
CVE-2026-34183 |
2369797 | clickhouse | libcrypto3 |
CVE-2026-34743 |
2315721, 2316161 | baseos, postgres | liblzma5, xz-libs |
CVE-2026-34986 |
2314969 | system-manager | github.com/go-jose/go-jose/v4 |
CVE-2026-35469 |
2315085 | backend | github.com/moby/spdystream |
CVE-2026-3783 |
2315485, 2315725 | curl, postgres | curl, libcurl |
CVE-2026-3784 |
2315489, 2315729 | curl, postgres | curl, libcurl |
CVE-2026-3805 |
2315493, 2315733 | curl, postgres | curl, libcurl |
CVE-2026-3832 |
2316077 | baseos | libgnutls30t64 |
CVE-2026-3833 |
2316081 | baseos | libgnutls30t64 |
CVE-2026-39820 |
2315089, 2315165, 2315337, 2315513, 2315773, 2316033 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-39823 |
2315093, 2315169, 2315341, 2315517, 2315777, 2316037 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-39825 |
2315097, 2315173, 2315345, 2315521, 2315781, 2316041 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-39826 |
2315101, 2315177, 2315349, 2315525, 2315785, 2316045 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-39836 |
2315105, 2315181, 2315353, 2315529, 2315789, 2316049 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-39882 |
2315409 | otel-collector | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp |
CVE-2026-40179 |
2315413 | otel-collector | github.com/prometheus/prometheus |
CVE-2026-40200 |
2315445 | vault | musl |
CVE-2026-40898 |
2314977, 2314993, 2315133 | backend, provisioning, system-manager | github.com/quic-go/quic-go |
CVE-2026-41242 |
2315209 | zitadel-login | protobufjs |
CVE-2026-41567 |
2315389 | otel-collector | github.com/docker/docker |
CVE-2026-41568 |
2315417 | otel-collector | github.com/docker/docker |
CVE-2026-41602 |
2315037, 2315449 | vault, vault-unsealer | github.com/apache/thrift |
CVE-2026-41889 |
2314997, 2315033, 2315049, 2315473 | otel-config-builder, provisioning, vault, vault-unsealer | github.com/jackc/pgx/v5 |
CVE-2026-41989 |
2316089 | baseos | libgcrypt20 |
CVE-2026-42009 |
2316093 | baseos | libgnutls30t64 |
CVE-2026-42010 |
2316097 | baseos | libgnutls30t64 |
CVE-2026-42011 |
2316101 | baseos | libgnutls30t64 |
CVE-2026-42012 |
2316105 | baseos | libgnutls30t64 |
CVE-2026-42013 |
2316109 | baseos | libgnutls30t64 |
CVE-2026-42014 |
2316113 | baseos | libgnutls30t64 |
CVE-2026-42015 |
2316117 | baseos | libgnutls30t64 |
CVE-2026-42151 |
2315393 | otel-collector | github.com/prometheus/prometheus |
CVE-2026-42154 |
2315397 | otel-collector | github.com/prometheus/prometheus |
CVE-2026-42306 |
2315401 | otel-collector | github.com/docker/docker |
CVE-2026-42499 |
2315109, 2315185, 2315357, 2315533, 2315793, 2316053 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-42504 |
2315149, 2315201, 2315373, 2315573, 2315833, 2316169 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-42507 |
2315153, 2315205, 2315377, 2315577, 2315837, 2316173 | backend, baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
CVE-2026-42764 |
2369801 | clickhouse | libcrypto3 |
CVE-2026-42766 |
2369817 | clickhouse | libcrypto3 |
CVE-2026-42767 |
2369821 | clickhouse | libcrypto3 |
CVE-2026-42768 |
2369825 | clickhouse | libcrypto3 |
CVE-2026-42769 |
2369829 | clickhouse | libcrypto3 |
CVE-2026-42770 |
2369833 | clickhouse | libcrypto3 |
CVE-2026-44288 |
2315285 | zitadel-login | – |
CVE-2026-44289 |
2315217 | zitadel-login | protobufjs |
CVE-2026-44290 |
2315221 | zitadel-login | protobufjs |
CVE-2026-44291 |
2315225 | zitadel-login | protobufjs |
CVE-2026-44292 |
2315289 | zitadel-login | protobufjs |
CVE-2026-44293 |
2315229 | zitadel-login | protobufjs |
CVE-2026-44294 |
2315293 | zitadel-login | protobufjs |
CVE-2026-44503 |
2315041, 2315453 | vault, vault-unsealer | github.com/microsoft/kiota-http-go |
CVE-2026-44572 |
2315321 | zitadel-login | next |
CVE-2026-44573 |
2315233 | zitadel-login | next |
CVE-2026-44574 |
2315237 | zitadel-login | next |
CVE-2026-44575 |
2315241 | zitadel-login | next |
CVE-2026-44576 |
2315297 | zitadel-login | next |
CVE-2026-44577 |
2315301 | zitadel-login | next |
CVE-2026-44578 |
2315245 | zitadel-login | next |
CVE-2026-44579 |
2315249 | zitadel-login | next |
CVE-2026-44580 |
2315305 | zitadel-login | next |
CVE-2026-44581 |
2315309 | zitadel-login | next |
CVE-2026-44582 |
2315325 | zitadel-login | next |
CVE-2026-44671 |
2315885 | zitadel | github.com/zitadel/zitadel |
CVE-2026-44902 |
2315253 | zitadel-login | – |
CVE-2026-44903 |
2315421 | otel-collector | github.com/prometheus/prometheus |
CVE-2026-45109 |
2315257 | zitadel-login | next |
CVE-2026-45445 |
2369805 | clickhouse | libcrypto3 |
CVE-2026-45446 |
2369837 | clickhouse | libcrypto3 |
CVE-2026-45447 |
2369789 | clickhouse | libcrypto3 |
CVE-2026-45740 |
2315317 | zitadel-login | protobufjs |
CVE-2026-46680 |
2314973, 2315189, 2315361 | linkerd-controller, linkerd-policy-controller, system-manager | github.com/containerd/containerd |
CVE-2026-5260 |
2316129 | baseos | libgnutls30t64 |
CVE-2026-5419 |
2316133 | baseos | libgnutls30t64 |
CVE-2026-5450 |
2315545, 2315805 | linkerd-proxy, linkerd-proxy-init | glibc |
CVE-2026-5704 |
2316141 | baseos | tar |
CVE-2026-5928 |
2315549, 2315809 | linkerd-proxy, linkerd-proxy-init | glibc |
CVE-2026-5958 |
2316145 | baseos | sed |
CVE-2026-6042 |
2315469 | vault | musl |
CVE-2026-6732 |
2315645 | postgres | libxml2 |
CVE-2026-7383 |
2369841 | clickhouse | libcrypto3 |
CVE-2026-8286 |
2369661 | curl | curl |
CVE-2026-8458 |
2369665 | curl | curl |
CVE-2026-8924 |
2369669 | curl | curl |
CVE-2026-8925 |
2369629 | curl | curl |
CVE-2026-8926 |
2369673 | curl | curl |
CVE-2026-8927 |
2369633 | curl | curl |
CVE-2026-8932 |
2369689 | curl | curl |
CVE-2026-9076 |
2369845 | clickhouse | libcrypto3 |
CVE-2026-9079 |
2369637 | curl | curl |
CVE-2026-9080 |
2369677 | curl | curl |
CVE-2026-9545 |
2369681 | curl | curl |
CVE-2026-9546 |
2369693 | curl | curl |
CVE-2026-9547 |
2369685 | curl | curl |