{"schema_version":"1.7.5","id":"openSUSE-SU-2026:21266-1","published":"2026-07-06T21:23:10Z","modified":"2026-07-09T10:00:12.153569517Z","related":["CVE-2026-26996","CVE-2026-27904","CVE-2026-6321"],"upstream":["CVE-2026-26996","CVE-2026-27904","CVE-2026-6321"],"summary":"Security update for openQA, os-autoinst","details":"This update for openQA, os-autoinst fixes the following issues:\n\nChanges in openQA:\n\n- Update to version 5.1783076943.6691832d:\n  * test: Stabilize `t/05-scheduler-full.t`\n\n- Clarify resolution of three CVEs\n  * The following CVEs have been fixed (see previous changelog\n    entries that mentioned only the according Bugzilla tickets):\n    - bsc#1259005 - CVE-2026-27904\n    - bsc#1264376 - CVE-2026-6321\n    - bsc#1258632 - CVE-2026-26996\n\n- Update to version 5.1782995932.ffeb09be:\n  * feat: throw 404 for nonexistent groups in overview\n  * feat: Avoid logwarn notifications for non-critical auth error\n  * chore(deps): Dependency cron 2026-07-02\n  * git subrepo pull (merge) external/os-autoinst-common\n  * fix: Check also hidden files in checklist plugin\n  * test: Enable faster re-connects in full scheduler test consistently\n  * test: Avoid silent daemons in verbose mode\n  * test: Allow running `t/43-…-scalability.t` in parallel\n  * test: Allow running `t/05-scheduler-full.t` in parallel\n  * test: Avoid race condition when generating ports in `25-cache.t`\n  * test: Avoid wasting seconds in `40-script_load_dump_templates.t`\n  * refactor: Remove disabled code in `openqa-load-templates`\n  * test: Avoid race condition when generating ports in many tests\n  * chore(deps): Dependency cron 2026-07-01\n  * fix(ci): format inline comments in workflows to pass yamllint\n  * test: Avoid running into \"Address already in use\" in fullstack test\n  * feat(ci): pin GitHub Actions by commit hash\n\nChanges in os-autoinst:\n\n- Update to version 5.1783082953.c3cb41d:\n  * test: Disable unstable `t/28-signalblocker.t` on ppc64le OBS builds\n  * fix: Check also hidden files in checklist plugin\n  * feat(ci): disable Mergify interactive queue controls in PR comments\n  * test: assert pipe size adjustment dynamically\n  * test: assert terminal session boundary safety\n  * refactor: support pretty markers in script_sudo and become_root\n  * fix: mmapi test failures and infinite loop hangs\n  * test: simplify Level 3 pretty marker detection\n  * fix: exclude virt-firmware on all older Leap archs\n\n- Update to version 5.1782917048.dcc97e9:\n  * fix: Check also hidden files in checklist plugin\n  * feat(ci): disable Mergify interactive queue controls in PR comments\n  * fix(ci): format inline comments in workflows to pass yamllint\n  * feat(ci): pin GitHub Actions by commit hash\n  * test: assert pipe size adjustment dynamically\n  * test: assert terminal session boundary safety\n  * refactor: support pretty markers in script_sudo and become_root\n  * fix: mmapi test failures and infinite loop hangs\n  * test: simplify Level 3 pretty marker detection\n  * fix: exclude virt-firmware on all older Leap archs\n","affected":[{"package":{"name":"openQA","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/openQA&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1783076943.6691832d-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"openQA":"5.1783076943.6691832d-bp160.1.1","openQA-auto-update":"5.1783076943.6691832d-bp160.1.1","openQA-bootstrap":"5.1783076943.6691832d-bp160.1.1","openQA-client":"5.1783076943.6691832d-bp160.1.1","openQA-client-bash-completion":"5.1783076943.6691832d-bp160.1.1","openQA-client-zsh-completion":"5.1783076943.6691832d-bp160.1.1","openQA-common":"5.1783076943.6691832d-bp160.1.1","openQA-continuous-update":"5.1783076943.6691832d-bp160.1.1","openQA-devel":"5.1783076943.6691832d-bp160.1.1","openQA-doc":"5.1783076943.6691832d-bp160.1.1","openQA-llm-server":"5.1783076943.6691832d-bp160.1.1","openQA-local-db":"5.1783076943.6691832d-bp160.1.1","openQA-mcp":"5.1783076943.6691832d-bp160.1.1","openQA-munin":"5.1783076943.6691832d-bp160.1.1","openQA-python-scripts":"5.1783076943.6691832d-bp160.1.1","openQA-single-instance":"5.1783076943.6691832d-bp160.1.1","openQA-single-instance-nginx":"5.1783076943.6691832d-bp160.1.1","openQA-worker":"5.1783076943.6691832d-bp160.1.1","os-autoinst":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-devel":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-ipmi-deps":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-openvswitch":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-qemu-kvm":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-qemu-x86":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-s390-deps":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-swtpm":"5.1783082953.c3cb41d-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21266-1.json"}},{"package":{"name":"os-autoinst","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/os-autoinst&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1783082953.c3cb41d-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"openQA":"5.1783076943.6691832d-bp160.1.1","openQA-auto-update":"5.1783076943.6691832d-bp160.1.1","openQA-bootstrap":"5.1783076943.6691832d-bp160.1.1","openQA-client":"5.1783076943.6691832d-bp160.1.1","openQA-client-bash-completion":"5.1783076943.6691832d-bp160.1.1","openQA-client-zsh-completion":"5.1783076943.6691832d-bp160.1.1","openQA-common":"5.1783076943.6691832d-bp160.1.1","openQA-continuous-update":"5.1783076943.6691832d-bp160.1.1","openQA-devel":"5.1783076943.6691832d-bp160.1.1","openQA-doc":"5.1783076943.6691832d-bp160.1.1","openQA-llm-server":"5.1783076943.6691832d-bp160.1.1","openQA-local-db":"5.1783076943.6691832d-bp160.1.1","openQA-mcp":"5.1783076943.6691832d-bp160.1.1","openQA-munin":"5.1783076943.6691832d-bp160.1.1","openQA-python-scripts":"5.1783076943.6691832d-bp160.1.1","openQA-single-instance":"5.1783076943.6691832d-bp160.1.1","openQA-single-instance-nginx":"5.1783076943.6691832d-bp160.1.1","openQA-worker":"5.1783076943.6691832d-bp160.1.1","os-autoinst":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-devel":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-ipmi-deps":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-openvswitch":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-qemu-kvm":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-qemu-x86":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-s390-deps":"5.1783082953.c3cb41d-bp160.1.1","os-autoinst-swtpm":"5.1783082953.c3cb41d-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21266-1.json"}}],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258632"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259005"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264376"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-26996"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27904"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6321"}]}