Security updates¶
This page lists the fixed CVEs for this release.
List of fixed CVEs¶
The following table lists the Common Vulnerabilities and Exposures (CVE) fixes included in this release.
| CVE number | Bug IDs | Image names | Package name |
|---|---|---|---|
| CVE-2022-26047 | 2553777 | HostOS | HostOS |
| CVE-2024-2236 | 2494361, 2549485 | baseos | libgcrypt20 |
| CVE-2025-11964 | 2554145 | HostOS | HostOS |
| CVE-2025-15649 | 2494593, 2549341 | baseos | perl-base |
| CVE-2025-29943 | 2494617 | HostOS | HostOS |
| CVE-2025-5278 | 2494685, 2549493 | baseos | coreutils |
| CVE-2025-59375 | 2494705 | HostOS | HostOS |
| CVE-2025-6141 | 2494713, 2549497 | baseos | libncursesw6 |
| CVE-2025-61984 | 2555249 | HostOS | HostOS |
| CVE-2026-0799 | 2554329 | HostOS | HostOS |
| CVE-2026-10722 | 2548777 | otel-collector | github.com/cilium/ebpf |
| CVE-2026-10723 | 2494889 | HostOS | HostOS |
| CVE-2026-10822 | 2494897 | HostOS | HostOS |
| CVE-2026-11331 | 2494901 | HostOS | HostOS |
| CVE-2026-11605 | 2494921 | HostOS | HostOS |
| CVE-2026-11622 | 2494925 | HostOS | HostOS |
| CVE-2026-11721 | 2494929 | HostOS | HostOS |
| CVE-2026-11856 | 2494941 | HostOS | HostOS |
| CVE-2026-12087 | 2494961, 2549345 | baseos | perl-base |
| CVE-2026-12617 | 2494977 | HostOS | HostOS |
| CVE-2026-13204 | 2494997 | HostOS | HostOS |
| CVE-2026-13221 | 2495001, 2549349 | baseos | perl-base |
| CVE-2026-13321 | 2495005 | HostOS | HostOS |
| CVE-2026-13595 | 2495009, 2549353 | baseos | bsdutils |
| CVE-2026-13757 | 2495013, 2549357 | baseos | libp11-kit0 |
| CVE-2026-14257 | 2547889 | zitadel-login | brace-expansion |
| CVE-2026-14456 | 2547893, 2549149 | vault, zitadel-login | libcrypto3 |
| CVE-2026-14457 | 2547945, 2549225 | vault, zitadel-login | libcrypto3 |
| CVE-2026-15157 | 2547913 | zitadel-login | undici |
| CVE-2026-15308 | 2495025 | HostOS | HostOS |
| CVE-2026-15370 | 2495029 | HostOS | HostOS |
| CVE-2026-15534 | 2495033, 2549361 | baseos | perl-base |
| CVE-2026-15588 | 2495037 | HostOS | HostOS |
| CVE-2026-15816 | 2554381 | HostOS | HostOS |
| CVE-2026-16118 | 2495057 | HostOS | HostOS |
| CVE-2026-16445 | 2554393 | HostOS | HostOS |
| CVE-2026-16728 | 2547917 | zitadel-login | undici |
| CVE-2026-16729 | 2547921 | zitadel-login | undici |
| CVE-2026-18295 | 2495077 | HostOS | HostOS |
| CVE-2026-18296 | 2495081 | HostOS | HostOS |
| CVE-2026-18297 | 2495085 | HostOS | HostOS |
| CVE-2026-18298 | 2495089 | HostOS | HostOS |
| CVE-2026-18299 | 2495093 | HostOS | HostOS |
| CVE-2026-18374 | 2548249, 2549321 | linkerd-proxy, linkerd-proxy-init | glibc-2.44 |
| CVE-2026-18798 | 2547925, 2549201 | vault, zitadel-login | libcrypto3 |
| CVE-2026-18938 | 2495117, 2549377 | baseos | libp11-kit0 |
| CVE-2026-19487 | 2495125, 2549381 | baseos | perl-base |
| CVE-2026-19499 | 2548253, 2549325, 2549385 | baseos, linkerd-proxy, linkerd-proxy-init | glibc-2.44, libc-bin |
| CVE-2026-19542 | 2548257, 2549329, 2549389 | baseos, linkerd-proxy, linkerd-proxy-init | glibc-2.44, libc-bin |
| CVE-2026-19774 | 2554481 | HostOS | HostOS |
| CVE-2026-2100 | 2554521 | HostOS | HostOS |
| CVE-2026-25645 | 2554533 | HostOS | HostOS |
| CVE-2026-25680 | 2548837 | vault-sidecar | golang.org/x/net |
| CVE-2026-25681 | 2548789 | vault-sidecar | golang.org/x/net |
| CVE-2026-27136 | 2548793 | vault-sidecar | golang.org/x/net |
| CVE-2026-27171 | 2495289, 2549501 | baseos | zlib1g |
| CVE-2026-27456 | 2495293, 2549393 | baseos | bsdutils |
| CVE-2026-32776 | 2495377 | HostOS | HostOS |
| CVE-2026-32777 | 2495381 | HostOS | HostOS |
| CVE-2026-32778 | 2495385 | HostOS | HostOS |
| CVE-2026-33186 | 2548609, 2549049 | fleet-manager, provisioning | google.golang.org/grpc |
| CVE-2026-33630 | 2554565 | HostOS | HostOS |
| CVE-2026-33818 | 2547969, 2548269, 2548613, 2548677, 2548709, 2548797, 2548977, 2549117, 2549153 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-34073 | 2554569 | HostOS | HostOS |
| CVE-2026-39821 | 2547973, 2548273, 2548617, 2548681, 2548713, 2548801, 2548981, 2549121, 2549157 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | golang.org/x/net, stdlib |
| CVE-2026-39824 | 2548265, 2548853, 2549337 | linkerd-proxy, linkerd-proxy-init, vault-sidecar | golang.org/x/sys |
| CVE-2026-41080 | 2495469 | HostOS | HostOS |
| CVE-2026-42250 | 2495497, 2549509 | baseos | libbz2-1.0 |
| CVE-2026-42497 | 2495501 | HostOS | HostOS |
| CVE-2026-42502 | 2548841 | vault-sidecar | golang.org/x/net |
| CVE-2026-42506 | 2548845 | vault-sidecar | golang.org/x/net |
| CVE-2026-4360 | 2496029 | HostOS | HostOS |
| CVE-2026-43871 | 2547977, 2549161 | vault, vault-unsealer | github.com/apache/thrift |
| CVE-2026-45186 | 2496061 | HostOS | HostOS |
| CVE-2026-46600 | 2547981, 2548277, 2548621, 2548685, 2548985, 2549061, 2549125, 2549165 | fleet-manager, otel-config-builder, provisioning, system-manager, vault, vault-unsealer, victoriametrics, zitadel-bootstrap | golang.org/x/net, stdlib |
| CVE-2026-4739 | 2496481 | HostOS | HostOS |
| CVE-2026-48522 | 2554669 | HostOS | HostOS |
| CVE-2026-48526 | 2554685 | HostOS | HostOS |
| CVE-2026-48959 | 2496513, 2549397 | baseos | perl-base |
| CVE-2026-48961 | 2496517 | HostOS | HostOS |
| CVE-2026-48962 | 2496521, 2549401 | baseos | perl-base |
| CVE-2026-50163 | 2548281 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-50219 | 2496529 | HostOS | HostOS |
| CVE-2026-53493 | 2548325 | system-manager | github.com/containerd/containerd |
| CVE-2026-53495 | 2548329 | system-manager | github.com/containerd/containerd |
| CVE-2026-53612 | 2496541, 2549405 | baseos | bsdutils |
| CVE-2026-53613 | 2496545, 2549409 | baseos | bsdutils |
| CVE-2026-53614 | 2496549, 2549413 | baseos | bsdutils |
| CVE-2026-53615 | 2496553, 2549417 | baseos | bsdutils |
| CVE-2026-53910 | 2496637, 2549421 | baseos | diffutils |
| CVE-2026-54272 | 2547929 | zitadel-login | ip-address |
| CVE-2026-54371 | 2496653, 2549425 | baseos | libattr1 |
| CVE-2026-54874 | 2547949, 2549229, 2549513 | baseos, vault, zitadel-login | libcrypto3, libssl3t64 |
| CVE-2026-55654 | 2496673 | HostOS | HostOS |
| CVE-2026-55655 | 2496677 | HostOS | HostOS |
| CVE-2026-55677 | 2548889 | backend | github.com/labstack/echo/v4 |
| CVE-2026-56115 | 2554805 | HostOS | HostOS |
| CVE-2026-56116 | 2554809 | HostOS | HostOS |
| CVE-2026-56131 | 2554817 | HostOS | HostOS |
| CVE-2026-56132 | 2554821 | HostOS | HostOS |
| CVE-2026-56391 | 2496725 | HostOS | HostOS |
| CVE-2026-56403 | 2496733 | HostOS | HostOS |
| CVE-2026-56404 | 2496737 | HostOS | HostOS |
| CVE-2026-56405 | 2496741 | HostOS | HostOS |
| CVE-2026-56406 | 2554829 | HostOS | HostOS |
| CVE-2026-56407 | 2554833 | HostOS | HostOS |
| CVE-2026-56408 | 2496753 | HostOS | HostOS |
| CVE-2026-56409 | 2554837 | HostOS | HostOS |
| CVE-2026-56410 | 2554841 | HostOS | HostOS |
| CVE-2026-56411 | 2554845 | HostOS | HostOS |
| CVE-2026-56412 | 2496769 | HostOS | HostOS |
| CVE-2026-56853 | 2547985, 2548285, 2548625, 2548689, 2548721, 2548809, 2548989, 2549129, 2549169 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-56854 | 2547989, 2548289, 2548629, 2548725, 2549069, 2549173 | fleet-manager, otel-collector, provisioning, system-manager, vault, vault-unsealer | golang.org/x/crypto |
| CVE-2026-56855 | 2548017, 2548333, 2548761, 2548933, 2548961, 2549033, 2549101, 2549205 | backend, fleet-manager, linkerd-controller, linkerd-policy-controller, otel-collector, system-manager, vault, vault-unsealer | golang.org/x/crypto |
| CVE-2026-56858 | 2547993, 2548293, 2548633, 2548693, 2548729, 2548813, 2548997, 2549137, 2549181 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-56859 | 2547997, 2548297, 2548637, 2548697, 2548733, 2548817, 2548997, 2549137, 2549181 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-56860 | 2548001, 2548301, 2548641, 2548701, 2548737, 2548821, 2549001, 2549141, 2549185 | otel-collector, otel-config-builder, provisioning, system-manager, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-56862 | 2548005, 2548645, 2548705, 2548825, 2549005, 2549145, 2549189 | otel-config-builder, provisioning, vault, vault-sidecar, vault-unsealer, victoriametrics, zitadel-bootstrap | stdlib |
| CVE-2026-57062 | 2496773, 2549517 | baseos | gpgv |
| CVE-2026-57432 | 2496781, 2549429 | baseos | perl-base |
| CVE-2026-57433 | 2496785, 2549433 | baseos | perl-base |
| CVE-2026-58010 | 2496817 | HostOS | HostOS |
| CVE-2026-58011 | 2496821 | HostOS | HostOS |
| CVE-2026-58012 | 2496825 | HostOS | HostOS |
| CVE-2026-58013 | 2496829 | HostOS | HostOS |
| CVE-2026-58014 | 2496833 | HostOS | HostOS |
| CVE-2026-58015 | 2496837 | HostOS | HostOS |
| CVE-2026-58016 | 2496841 | HostOS | HostOS |
| CVE-2026-59843 | 2496877 | HostOS | HostOS |
| CVE-2026-59844 | 2496881 | HostOS | HostOS |
| CVE-2026-59845 | 2496885 | HostOS | HostOS |
| CVE-2026-59846 | 2496889 | HostOS | HostOS |
| CVE-2026-59847 | 2496893 | HostOS | HostOS |
| CVE-2026-59848 | 2496897 | HostOS | HostOS |
| CVE-2026-59849 | 2496901 | HostOS | HostOS |
| CVE-2026-59850 | 2496905 | HostOS | HostOS |
| CVE-2026-59995 | 2555197 | HostOS | HostOS |
| CVE-2026-59996 | 2555201 | HostOS | HostOS |
| CVE-2026-59997 | 2555205 | HostOS | HostOS |
| CVE-2026-59998 | 2555209 | HostOS | HostOS |
| CVE-2026-59999 | 2555213 | HostOS | HostOS |
| CVE-2026-60000 | 2555217 | HostOS | HostOS |
| CVE-2026-60001 | 2555221 | HostOS | HostOS |
| CVE-2026-60002 | 2555225 | HostOS | HostOS |
| CVE-2026-63072 | 2547933, 2549209, 2549437 | baseos, vault, zitadel-login | libcrypto3, libssl3t64 |
| CVE-2026-63073 | 2547953, 2549233 | vault, zitadel-login | libcrypto3 |
| CVE-2026-63074 | 2547957, 2549237, 2549521 | baseos, vault, zitadel-login | libcrypto3, libssl3t64 |
| CVE-2026-63075 | 2547961, 2549241 | vault, zitadel-login | libcrypto3 |
| CVE-2026-63076 | 2547937, 2549213, 2549441 | baseos, vault, zitadel-login | libcrypto3, libssl3t64 |
| CVE-2026-63381 | 2496985 | HostOS | HostOS |
| CVE-2026-63382 | 2496989 | HostOS | HostOS |
| CVE-2026-63383 | 2496993 | HostOS | HostOS |
| CVE-2026-63384 | 2496997 | HostOS | HostOS |
| CVE-2026-63385 | 2497001 | HostOS | HostOS |
| CVE-2026-63388 | 2554889 | HostOS | HostOS |
| CVE-2026-6368 | 2497017, 2549445 | baseos | libc-bin |
| CVE-2026-6390 | 2497021 | HostOS | HostOS |
| CVE-2026-66046 | 2554905 | HostOS | HostOS |
| CVE-2026-66484 | 2497033 | HostOS | HostOS |
| CVE-2026-66485 | 2497037 | HostOS | HostOS |
| CVE-2026-66486 | 2497041 | HostOS | HostOS |
| CVE-2026-67422 | 2497045 | HostOS | HostOS |
| CVE-2026-6791 | 2497049, 2549449 | baseos | libc-bin |
| CVE-2026-6893 | 2554917 | HostOS | HostOS |
| CVE-2026-69152 | 2547897 | zitadel-login | brace-expansion |
| CVE-2026-69192 | 2547901 | zitadel-login | ip-address |
| CVE-2026-69198 | 2547941 | zitadel-login | ip-address |
| CVE-2026-69247 | 2497073 | HostOS | HostOS |
| CVE-2026-69248 | 2497077 | HostOS | HostOS |
| CVE-2026-69249 | 2497081 | HostOS | HostOS |
| CVE-2026-7017 | 2497085, 2549453 | baseos | perl-base |
| CVE-2026-72522 | 2554985 | HostOS | HostOS |
| CVE-2026-73073 | 2497157 | HostOS | HostOS |
| CVE-2026-73281 | 2497165 | HostOS | HostOS |
| CVE-2026-73282 | 2497169 | HostOS | HostOS |
| CVE-2026-73283 | 2497173 | HostOS | HostOS |
| CVE-2026-73566 | 2547905 | zitadel-login | tar |
| CVE-2026-75604 | 2547881 | zitadel-login | next |
| CVE-2026-75803 | 2497181, 2547965, 2549245, 2549525 | baseos, vault, zitadel-login | libcrypto3, libssl3t64 |
| CVE-2026-76163 | 2555009 | HostOS | HostOS |
| CVE-2026-76641 | 2555013 | HostOS | HostOS |
| CVE-2026-76781 | 2555021 | HostOS | HostOS |
| CVE-2026-76956 | 2497193 | HostOS | HostOS |
| CVE-2026-76957 | 2555025 | HostOS | HostOS |
| CVE-2026-77117 | 2549457 | baseos | libc-bin |
| CVE-2026-77692 | 2555033 | HostOS | HostOS |
| CVE-2026-78662 | 2548021, 2548337, 2548765, 2548937, 2548965, 2549037, 2549105, 2549217 | backend, fleet-manager, linkerd-controller, linkerd-policy-controller, otel-collector, system-manager, vault, vault-unsealer | golang.org/x/crypto |
| CVE-2026-80185 | 2555057 | HostOS | HostOS |
| CVE-2026-80186 | 2555061 | HostOS | HostOS |
| CVE-2026-80489 | 2549461 | baseos | libc-bin |
| CVE-2026-81870 | 2548029, 2548781, 2549249 | otel-collector, vault, vault-unsealer | go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/sdk |
| CVE-2026-81871 | 2548769 | otel-collector | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc |
| CVE-2026-82474 | 2555093 | HostOS | HostOS |
| CVE-2026-84303 | 2548025, 2548341, 2548669, 2548773, 2548849, 2548969, 2549041, 2549109, 2549221 | fleet-manager, linkerd-controller, linkerd-policy-controller, otel-collector, provisioning, system-manager, vault, vault-sidecar, vault-unsealer | google.golang.org/grpc |
| CVE-2026-84304 | 2548009, 2548649, 2548745, 2548829, 2548953, 2549025, 2549089, 2549193 | fleet-manager, linkerd-controller, linkerd-policy-controller, otel-collector, provisioning, vault, vault-sidecar, vault-unsealer | google.golang.org/grpc |
| CVE-2026-84445 | 2548013, 2548313, 2548653, 2548749, 2548833, 2548957, 2549029, 2549093, 2549197 | fleet-manager, linkerd-controller, linkerd-policy-controller, otel-collector, provisioning, system-manager, vault, vault-sidecar, vault-unsealer | google.golang.org/grpc |
| CVE-2026-85731 | 2548317 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-85732 | 2548345 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-86138 | 2555113 | HostOS | HostOS |
| CVE-2026-86139 | 2555117 | HostOS | HostOS |
| CVE-2026-86142 | 2555125 | HostOS | HostOS |
| CVE-2026-86143 | 2555129 | HostOS | HostOS |
| CVE-2026-86144 | 2555133 | HostOS | HostOS |
| CVE-2026-88806 | 2555153 | HostOS | HostOS |
| CVE-2026-8932 | 2497233 | HostOS | HostOS |
| CVE-2026-9375 | 2497245 | HostOS | HostOS |
| CVE-2026-9538 | 2497253, 2549481 | baseos | perl-base |