SUSE-SU-2026:20538-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202620538-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20538-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:20538-1
Upstream
Related
Published
2026-02-17T14:33:01Z
Modified
2026-03-11T07:31:52.894034Z
Summary
Security update for cockpit-machines, cockpit
Details

This update for cockpit-machines, cockpit fixes the following issues:

  • CVE-2025-13465: Update the lodash dependencie to avoid prototype pollution. (bsc#1257324)

Changes in cockpit-machines:

  • Update to 346

    • 346
      • Performance improvements
      • Translation updates
    • 345
      • New virtual machines don't get SPICE graphics anymore
      • Support for network port forwarding
      • Bug fixes and translation updates

  • Update to 344

    • 344
      • Port forwarding for user session VMs
      • "Shutdown and restart" action
      • Faster startup
    • 343
      • Memory usage now shows numbers reported by the guest (RHEL-116731)

  • Update to 342

    • 342
      • Bug fixes and translation updates
    • 341
      • Improved UX for Disks and Network interface tables
      • Bug fixes and translation updates
    • 340
      • Use exclusive VNC connections with "Remote resizing"

  • Update to 339

    • 339
      • Serial consoles now keep their content and stay alive
      • No longer copies qemu.conf values into VM definitions
    • 338
      • Translation and dependency updates
      • Detachable VNC console

  • Update to 337

    • 337
      • Bug fixes and translation updates
    • 336
      • Graphical VNC and serial consoles improvements
      • Control VNC console resizing and scaling
      • Bug fixes and translation updates
    • 335
      • Bug fixes and translation updates
    • 334
      • Bug fixes and translation updates

Changes in cockpit:

  • Update to 354

    • changes since 351
      • 354
        • Convert documentation to AsciiDoc
        • Work around Firefox 146/147 bug (rhbz#2422331)
        • Bug fixes
      • 353
        • Networking: Suggest prefix length and gateway address
        • Bug fixes and translation updates
      • 352
        • Shown a warning if the last shutdown/reboot was unclean
        • Bug fixes and translation updates

  • Update to 351

    • Changes since 349
      • 351
        • Firewall ports can be deleted individually
      • 350
        • networking: fix renaming of bridges and other groups (RHEL-117883)
        • bridge: fix OpenSSH_10.2p1 host key detection

  • Update to 349

    • Changes since 346
      • 349
        • Package manifests: add any test
        • Bug fixes and translation updates
      • 348
        • Bug fixes and translation updates
      • 347
        • Site-specific branding support

  • Update to 346

    • Changes since 344
      • 346
        • Support branding Cockpit pages
        • Storage: Support for Stratis "V2" pools
      • 345
        • Translation and dependency updates
        • Shorter IPv6 addresses
        • IPv6 addresses for WireGuard

  • Update to 344

    • Changes since 340
      • 344
        • Bug fixes and translation updates
      • 343
        • login: Improve error message for unsupported shells
        • cockpit: Handle file access issues with files in machines.d
        • Translation updates
      • 342
        • systemd: ensure update() is called at least once for tuned-dialog
        • Translation updates
      • 341
        • services: show link to podman page for quadlets
        • Bug fixes and translation updates
References

Affected packages

SUSE:Linux Micro 6.2 / cockpit

Package

Name
cockpit
Purl
pkg:rpm/suse/cockpit&distro=SUSE%20Linux%20Micro%206.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
354-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "cockpit-firewalld": "354-160000.1.1",
            "cockpit-kdump": "354-160000.1.1",
            "cockpit-ws-selinux": "354-160000.1.1",
            "cockpit": "354-160000.1.1",
            "cockpit-ws": "354-160000.1.1",
            "cockpit-machines": "346-160000.1.1",
            "cockpit-networkmanager": "354-160000.1.1",
            "cockpit-selinux": "354-160000.1.1",
            "cockpit-system": "354-160000.1.1",
            "cockpit-bridge": "354-160000.1.1",
            "cockpit-storaged": "354-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20538-1.json"

SUSE:Linux Micro 6.2 / cockpit-machines

Package

Name
cockpit-machines
Purl
pkg:rpm/suse/cockpit-machines&distro=SUSE%20Linux%20Micro%206.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
346-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "cockpit-firewalld": "354-160000.1.1",
            "cockpit-kdump": "354-160000.1.1",
            "cockpit-ws-selinux": "354-160000.1.1",
            "cockpit": "354-160000.1.1",
            "cockpit-ws": "354-160000.1.1",
            "cockpit-machines": "346-160000.1.1",
            "cockpit-networkmanager": "354-160000.1.1",
            "cockpit-selinux": "354-160000.1.1",
            "cockpit-system": "354-160000.1.1",
            "cockpit-bridge": "354-160000.1.1",
            "cockpit-storaged": "354-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20538-1.json"