{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for google-guest-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for google-guest-agent fixes the following issues:\n\nUpdate to version 20260430.00\n\n  * Update THIRD_PARTY_LICENSES to be package specific location. (#608)\n  * Update dependencies and go version to 1.26.2 (#607)\n    (bsc#1265762, CVE-2026-33814)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n    (bsc#1260264, CVE-2026-33186)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n    (bsc#1239334, CVE-2025-22869, bsc#1253889, CVE-2025-58181)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260424.00\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260423.01\n  * Update THIRD_PARTY_LICENSES to be package specific location. (#608)\n- from version 20260423.00\n  * Update dependencies and go version to 1.26.2 (#607)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key\n    list is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260422.01\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260422.00\n  * Update dependencies and go version to 1.26.2 (#607)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key\n    list is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260421.00\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260414.00\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n- Bump Go API version to 1.26\n\n- Fix crafted JWE input with a missing encrypted key can lead to a denial\n of service (bsc#1262926, CVE-2026-34986)\n\n- Update to version 20260402.00: (bsc#1257010)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n\n- Update to version 20260108.00\n  * Source the contents of /var/google-users.d config files. (#586)\n\n- Update to version 20251223.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251218.01\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251218.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251216.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251215.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251210.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251209.00\n  * Force remove core plugin configuration for windows (#587)\n\n- Update to version 20251208.00\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list is passed\n    to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251206.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251205.00\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n\n- Update to version 20251120.01\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251120.00\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251117.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251115.00\n  * Don\u0027t delete the authorized_keys file when an empty key list is\n    passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251108.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251107.01\n  * Don\u0027t delete the authorized_keys file when an empty key list is\n    passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251031.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251030.02\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251030.01\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251030.00\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251011.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251009.01\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251009.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n\n- Update to version 20251007.00\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251006.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20251006.00\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251005.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250930.01\n  * Honor core plugin setting on windows package update (#576)\n- from version 20250929.01\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250929.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250926.00\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250924.02\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250924.01\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250924.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n\n- Update to version 20250923.01\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250923.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250921.00\n  * Add extra debug logging around toggling OS Login (#572)\n- from version 20250920.01\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250920.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250918.01\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250917.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250917.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250916.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250915.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- Disable missing daemon google_guest_agent_manager referenced by google-startup-scripts.service\n\n- Update to version 20250908.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250907.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250905.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250905.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250902.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- Build and install new gce_workload_cert_refresh binary\n- Fix installation source of google_metadata_script_runner_adapt script\n- Install new systemd service file\n  * gce-workload-cert-refresh.service\n\n- Update to version 20250901.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250831.03\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250831.02\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250831.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent\n    and disable core plugin (#557)\n- from version 20250831.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250830.02\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent\n    and disable core plugin (#557)\n- from version 20250830.01\n  * Update go version to 1.25 (#565)\n- from version 20250830.00\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250828.00\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n- from version 20250826.00\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250821.01\n  * Remove routes script from packaging (#566)\n- Update Go API version to 1.25\n\n- Update to version 20250718.00\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n\n- Update to version 20250709.02\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250709.01\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250709.00\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250702.00\n  * Update adapt script to run on startup/shutdown both (#561)\n- from version 20250701.01\n  * Update agent_uninstall.ps1 (#558)\n- from version 20250701.00\n  * Stop core plugin before removing agent package (#554)\n- from version 20250628.00\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n- from version 20250626.00\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523) (#540)\n- from version 20250625.00\n  * prepare stable release.\n- Install google_metadata_script_runner_adapt script (bsc#1245759)\n\n- Update to version 20250624.00\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n- from version 20250611.01\n  * prepare stable release.\n- from version 20250611.00\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n- from version 20250609.00\n  * prepare stable release.\n- from version 20250605.00\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are\n    written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata\n    script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of\n    modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n\n- Update to version 20250604.00\n  * Preparing stable build.\n- from version 20250602.00\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n- from version 20250521.00\n  * Preparing stable build.\n- from version 20250515.00\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n\n- Update to version 20250508.00\n  * Preparing stable build.\n\n- from version 20250506.01 (bsc#1243254, bsc#1243505)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-741",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21989-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21989-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621989-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21989-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047108.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1210938",
        "url": "https://bugzilla.suse.com/1210938"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239334",
        "url": "https://bugzilla.suse.com/1239334"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239944",
        "url": "https://bugzilla.suse.com/1239944"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243254",
        "url": "https://bugzilla.suse.com/1243254"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243505",
        "url": "https://bugzilla.suse.com/1243505"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1245759",
        "url": "https://bugzilla.suse.com/1245759"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1253889",
        "url": "https://bugzilla.suse.com/1253889"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257010",
        "url": "https://bugzilla.suse.com/1257010"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260264",
        "url": "https://bugzilla.suse.com/1260264"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262926",
        "url": "https://bugzilla.suse.com/1262926"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265762",
        "url": "https://bugzilla.suse.com/1265762"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      }
    ],
    "title": "Security update for google-guest-agent",
    "tracking": {
      "current_release_date": "2026-06-03T12:17:52Z",
      "generator": {
        "date": "2026-06-03T12:17:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21989-1",
      "initial_release_date": "2026-06-03T12:17:52Z",
      "revision_history": [
        {
          "date": "2026-06-03T12:17:52Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-1.1.aarch64",
                "product": {
                  "name": "google-guest-agent-20260430.00-1.1.aarch64",
                  "product_id": "google-guest-agent-20260430.00-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-1.1.s390x",
                "product": {
                  "name": "google-guest-agent-20260430.00-1.1.s390x",
                  "product_id": "google-guest-agent-20260430.00-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-1.1.x86_64",
                "product": {
                  "name": "google-guest-agent-20260430.00-1.1.x86_64",
                  "product_id": "google-guest-agent-20260430.00-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64"
        },
        "product_reference": "google-guest-agent-20260430.00-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x"
        },
        "product_reference": "google-guest-agent-20260430.00-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        },
        "product_reference": "google-guest-agent-20260430.00-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
          "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.s390x",
            "SUSE Linux Micro 6.0:google-guest-agent-20260430.00-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-03T12:17:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    }
  ]
}