Release notes for Uyuni Server

Version 2026.10
2026-10-19 11:06:55 +0200
Table of Contents

  • Version Revision History
  • Stay informed
  • Support
  • Release model
  • Major changes since Uyuni Server 2025.05
      □ Features and changes
          ☆ Version 2026.10
              ○ SSO: Default Authentication Context No Longer Enforced
              ○ Activation keys are deleted with their base channel
              ○ Product Migration from SLES 15 SP7 to 16.0 for SSH Minions
              ○ New API Endpoint for GPG Keys Management
              ○ ArtifactHub.io Publishing
              ○ Security fixes
              ○ Expanded Operating System Support
              ○ Improved Transactional System Management
              ○ Confidential Computing Attestation for IBM Z Series
              ○ New uyuni-tftpd Container
              ○ Documentation Updates
              ○ API Changes
              ○ Monitoring stack
          ☆ Version 2026.08
              ○ Release notes cleanup
              ○ Monitoring
              ○ Ubuntu 26.04 Support
              ○ openSUSE Leap 15.6 and openSUSE Leap Micro 5.X End-of-Life
                Notice
              ○ Security Fixes
          ☆ Version 2026.06
              ○ Containers OS switched from openSUSE Leap 15.6 to openSUSE Leap
                16.0
              ○ Upcoming Podman 6.0.0 and Breaking Changes
              ○ Product Migration from SUSE Linux Enterprise Server 15 SP7 to
                16.0
              ○ Support for FIPS-Enabled Host OS
              ○ SUSE Liberty Linux 9.6 Support
              ○ Security Fixes
              ○ Debian 12 End-of-Life Notice
              ○ SUSE Registry URL Change: Update Your Allowlist
          ☆ Version 2026.04
              ○ Red Hat Enterprise Linux 10 Support
              ○ Online Database backup management with mgradm
              ○ Enhanced SCAP Auditing Integration (Technology Preview)
              ○ Product Migration from SUSE Linux Enterprise Server 15 SP7 to
                16.0
              ○ Reporting Dashboard for Grafana
              ○ Installation scripts merged with container images
              ○ New API Endpoint: listMigrationTargetsWithChannels
              ○ Monitoring: Grafana
              ○ Important Security Update
          ☆ Version 2026.03
              ○ CVE Auditing with OVAL (tech preview)
              ○ New products enabled
              ○ Upgrade to Tomcat 11 and Hibernate 7
              ○ Monitoring: Grafana
              ○ Security fixes
          ☆ Monitoring Server Components for SLES 12 Client Tools
          ☆ Version 2026.01
              ○ New products enabled
              ○ openSUSE Leap 16.0 Support
              ○ UI Support for Ansible Playbook Variables
              ○ Role-Based Access Control (RBAC) Configuration via Web UI
              ○ Monitoring: Prometheus upgraded to 2.53.4
              ○ Containerized BIND and DHCP Support
              ○ Security fixes
              ○ Database image updated to PostgreSQL 18
              ○ mgradm migrate deprecation
              ○ Ubuntu 20.04 End of Life
          ☆ Version 2025.10
              ○ Critical Vulnerabilities Addressed
              ○ Validated host OS switched from openSUSE Leap Micro 5.5 to
                openSUSE Tumbleweed
              ○ openSUSE Tumbleweed as client
              ○ Bulk Product Migration via System Set Manager
              ○ Generate and Upload Support Data from the UI
              ○ Container-Based KIWI Image Build Support
              ○ Removal of POS_Image-RPi-Bootstrap and
                pxe-yomi-image-opensuse15
              ○ Uyuni API version upgrade and breaking changes
          ☆ Version 2025.07
              ○ Important Salt Security Update
              ○ Important Security Updates
          ☆ Version 2025.05
              ○ Separate Database Container
              ○ Role-Based Access Control (RBAC) Implementation
              ○ Online Synchronization for Hub and Peripheral Servers
              ○ Ansible Integration Enhancements
              ○ Backup and Restore Support
              ○ SUSE Linux Micro 6.1 support as client
              ○ SUSE Linux Enterprise 15 SP7 family as clients
              ○ Add MAC based terminal naming option
              ○ POS image templates updates
              ○ RPMs including the container images in Uyuni
              ○ Health Check Tool
              ○ Improved CVE Audit with OVAL Data (Technology Preview)
              ○ Password Policy Enforcement for New Users
              ○ Product Migration Enhancement
              ○ Uyuni Documentation API changes
              ○ Monitoring
              ○ Removed features
              ○ Deprecated features
              ○ Legacy SCAP Scan API Endpoints
  • Known issues
      □ Kernel and Kernel-Livepatch Errata split in SLE15 SP7
      □ Container Healthcheck may report Failure on slow startups
      □ Salt’s ansible module broken by upstream bug in google.cloud collection
      □ Availability of Salt’s "virt" module inside the Salt Bundle
      □ SSH SFTP Misconfiguration after SLES 16 Migration
      □ Uyuni 2025.10 fails to start because of ERROR: column "server_id" of
        relation "rhnactiondup" contains null values
      □ Hub XML-RPC Usage
      □ Onboarding Salt-SSH Managed Clients
      □ Reboot actions are not completed successfully
      □ Bootstrapping issue
      □ Issues with the Database Container
      □ salt-secrets-config.service fails to start after a migration
      □ Node Exporter port 9100 conflicts with Traefik
      □ Transactional systems - Salt SSH execution
      □ Onboarding issues in SUSE Linux Enterprise Micro and openSUSE Leap
        Micro 5.5
      □ Database restart
      □ AlmaLinux
      □ Bootstrap with web UI using non-root user
      □ CLM and custom repositories
      □ Container build host and Salt bundle
      □ Single Sign On, API and CLI tools
      □ EPEL and Salt packages
      □ Pay-as-you-go Connection requirement
      □ RHEL native clients
      □ Registering Spacewalk 2.x/Red Hat Satellite 5.x clients to Uyuni as
        Salt minions
      □ Ubuntu/Debian: duplicate entries in sources.list
  • Client Tools Notes
      □ Supported clients
  • Installation
      □ Requirements
      □ Installing the Server
      □ Update from previous versions of Uyuni Server
      □ Update from previous versions of Uyuni Proxy
  • Other information
      □ Red Hat Channels
      □ SUSE Channels
  • Providing feedback
  • Legal Notices

2026.10

Version Revision History

  • 2026/10/16: 2026.10 release

  • 2026/08/11: 2026.08 release

  • 2026/07/09: 2026.06 release

  • 2026/04/29: 2026.04 release

  • 2026/03/10: 2026.03 release

  • 2026/02/05: 2026.01 release

  • 2025/11/04: 2025.10 release

  • 2025/08/01: 2025.07 release

  • 2025/06/02: 2025.05 release

  • Older versions from 2021.12 up to 2024.12

  • Older versions up to 4.0.0

Stay informed

The Uyuni community is always growing and evolving! To keep up with the latest
news, updates, and upcoming events, be sure to visit our main website at
www.uyuni-project.org. There, you will find our latest announcements and social
media feeds so you never miss a beat.

Support

Uyuni is proudly driven by its users and contributors. Whether you are looking
for troubleshooting help, want to share your own expertise, or just want to say
hello, our community is here for you!

You can find all the ways to connect with us on our dedicated get involved page
. This is your central hub for our chat rooms, mailing lists, and issue
trackers. Please do not hesitate to reach out.

Release model

To bring you the latest features and improvements as quickly as possible, Uyuni
follows a rolling release model. Instead of backporting bug fixes to older
versions, we frequently release entirely new versions packed with both the
latest features and necessary fixes. This keeps the project moving forward at a
rapid, exciting pace!

If you have ideas, feedback, or want to contribute to our next release, we
would love to hear from you. Check out our contact page to find the best way to
get involved.

Major changes since Uyuni Server 2025.05

Features and changes

Version 2026.10

SSO: Default Authentication Context No Longer Enforced

The default rhn_java_sso.conf configuration no longer forces a specific SAML
authentication context from the Identity Provider (IdP). Previously, the
Password context was requested by default, which prevented modern passwordless
authentication methods (such as FIDO2, Yubikey, and Windows Hello) from
functioning correctly with strict SAML clients like Microsoft Edge. The default
behavior is now "let the IdP choose".

Action required for existing deployments: If your security policy requires
enforcing password-based authentication at the SAML protocol level, you can
override this by setting the properties in /etc/rhn/rhn.conf under the
java.sso.* namespace, or by uncommenting and setting the following lines in /
usr/share/rhn/config-defaults/rhn_java_sso.conf:

onelogin.saml2.security.requested_authncontext =
urn:oasis:names:tc:SAML:2.0:ac:classes:Password
onelogin.saml2.security.requested_authncontextcomparison = exact

Activation keys are deleted with their base channel

When you remove a base channel, Uyuni now also deletes all activation keys that
use it as their base channel. Previously, these activation keys remained in the
system and caused unwanted issues.

spacecmd now also warns you about affected activation keys before you remove a
channel.

 Before you remove a base channel, review the activation keys that depend on
 it. To keep an activation key, change its base channel first.

Product Migration from SLES 15 SP7 to 16.0 for SSH Minions

Uyuni now supports in-place product migrations from SUSE Linux Enterprise
Server 15 SP7 to 16.0 for SSH Minions. This update ensures that Salt action
states are handled correctly for Salt SSH clients and resolves post-migration
issues that previously caused ssh and scp services to fail on the managed
systems. IMPORTANT: SSH-Push with tunnel cannot be supported as the tunnel is
not open when during the packages download.

New API Endpoint for GPG Keys Management

Uyuni introduces new API endpoints to upload, list, and remove GPG keys,
enabling administrators to manage keys using external tools, most notably
mgrctl. To support this enhancement, the container architecture has been
modified to allow non-root users access to the necessary GPG directories.

ArtifactHub.io Publishing

Uyuni Server container images and Helm charts are now published under the
verified Uyuni-project organization on ArtifactHub.io, featuring
component-specific READMEs, enhanced chart keywords, and integrated release
changelogs.

Security fixes

This update addresses important security vulnerabilities. We recommend
upgrading your Uyuni instances as soon as possible.

  • CVE-2026-71400 - Cobbler: Remove cobbler_api endpoint from public interface
    (bsc#1274775, bsc#1274613)

  • CVE-2026-39821 - Alertmanager: Dropped the direct dependency on golang.org/
    x/net. (bsc#1266474)

  • CVE-2026-68497: jackson-databind: Duration XMLGregorianCalendar Unbounded
    Number Parse DoS (bsc#1280125)

  • CVE-2026-89407: jackson-core: ReDoS: quadratic backtracking in NumberInput
    PATTERN_FLOAT via looksLikeValidNumber (bsc#1282645)

  • CVE-2026-89425: jackson-core: UTF8DataInputJsonParser_reportInvalidToken()
    missing maxErrorTokenLength limit, unbounded StringBuilder growth (DoS (bsc
    #1282505)

  • CVE-2026-91777: jackson-databind: Quadratic forward-reference completion (
    bsc#1282492)

  • CVE-2026-91776: jackson-databind: Retains every unknown raw type ID (bsc#
    1282491)

  • CVE-2026-83557: jackson-databind: Comparable missing from
    DefaultBaseTypeLimitingValidator’s unsafe base types (incomplete
    PolymorphicTypeValidator denylist (bsc#1278008)

  • CVE-2026-19032: jackson-databind: Path Deserialization Missing Scheme
    Allowlist for FileSystemProvider Resolution (bsc#1277883)

There are also multiple CVEs fixed for venv-salt-minion and its dependencies,
some of which are rated critical upstream. Most of these are not practically
exploitable in a default Uyuni deployment. We still recommend updating your
clients as good practice and to stay protected in non-default configurations.

  • CVE-2025-13462: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE
    when parsing GNU long name or link headers (bsc#1259611).

  • CVE-2025-4330: Fixed an vulnerability in the tarfile data and tar
    extraction filters where crafted archives could create a symlink pointing
    outside the destination directory. This was a bypass of CVE-2025-4330 (bsc#
    1268977).

  • CVE-2026-15310: Bound the amount of data zipfile decompresses per read for
    members compressed with bzip2, LZMA, or Zstandard, matching the existing
    limit for deflate. A small archive member could previously expand into an
    unbounded allocation even when read in small chunks. (bsc#1277111)

  • CVE-2026-15806: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials
    to the URL scheme, preventing credentials stored for an HTTPS URL from
    being used for a matching HTTP URL, while URIs without a scheme continue to
    match any scheme. (bsc#1276223)

  • CVE-2026-17084: Change the stringprep module and encodings.idna codec to
    not consider Unicode codepoint attributes beyond those defined in RFC 3454.
    (bsc#1276226)

  • CVE-2026-19445: Fix a crash in ssl when an sni_callback switches a
    connection to another SSLContext and the context that carries the callback
    is no longer referenced by the application. Servers that keep their
    sni_callback context alive (the usual case when it wraps the listening
    socket or is stored on the server object) were not affected. (bsc#1283969)

  • CVE-2026-19553: asyncio: loop.start_tls() and loop.create_connection() now
    validate the server_hostname argument if an ssl.SSLContext is passed with
    check_hostname set to True, emitting DeprecationWarning if server_hostname
    is missing. (This will raise ValueError in Python 3.13 and later.) (bsc#
    1283826)

  • CVE-2026-19672: Fix the tarfile tar and data extraction filters creating
    directories outside the destination for members whose name leaves the
    destination and returns to it, such as ../evil/../dest/sub/file. The
    containment check used the resolved path, but intermediate directories were
    created from the name as given. (bsc#1276227)

  • CVE-2026-2297: Fixes CVE-2026-2297 by ensuring that SourcelessFileLoader
    uses io.open_code() when opening .pyc files (bsc#1259240).

  • CVE-2026-3644: Reject control characters in http.cookies.Morsel update()
    and js_output(). (bsc#1259734).

  • CVE-2026-4224: xml.parsers.expat: Fixed a crash caused by unbounded C
    recursion when converting deeply nested XML content models with
    ElementDeclHandler(). (bsc#1259735).

  • CVE-2026-4519: Reject leading dashes in URLs passed to webbrowser.open() (
    bsc#1260026).

  • CVE-2026-82049: Fixed a vulnerability in the tarfile data and tar
    extraction filters where a crafted archive using a hard link to a symbolic
    link could change the permissions and modification time of a file outside
    the destination directory, and expose its contents inside the extracted
    tree. (bsc#1280459)

  • CVE-2026-9669: Fix a possible stack buffer overflow in bz2 when a
    bz2.BZ2Decompressor is reused after a decompression error. The decompressor
    now becomes unusable after libbz2 reports an error (bsc#1267974).

  • CVE-2026-97689: denial of service due to unbounded memory allocation in
    chunk parser (bsc#1283912)

  • CVE-2026-97688: denial of service due to infinite loop during chunked
    Deflate decoding (bsc#1283913)

  • CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS
    configuration override (bsc#1283914)

  • CVE-2026-66046: denial of service vulnerability caused by quadratic
    algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#
    1275709)

  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to
    trigger memory corruption (bsc#1275915)

  • CVE-2026-76957: lacks handler call depth tracking with custom encoding
    callbacks, use-after-free can occur (bsc#1275859)

  • CVE-2026-76956: misinterpretation of getentropy’s return code leads to
    insufficient entropy, vulnerable to hash flooding denial of service (bsc#
    1275860)

  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low
    surrogates being treated the same as high surrogates during Unicode
    processing (bsc#1275593)

  • CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for
    calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or
    XML_ParserReset from within handlers in cases of a policy violation (bsc#
    1267631)

  • CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for
    calls to XML_ResumeParser from within handlers in cases of a policy
    violation (bsc#1268572)

  • CVE-2026-56132: libexpat before 2.8.2, there is a heap-based buffer
    overflow in doProlog in xmlparse.c (bsc#1268573)

  • CVE-2026-56403: libexpat before 2.8.2 has an integer overflow in storeAtts.
    (bsc#1275096)

  • CVE-2026-56404: libexpat before 2.8.2 has an integer overflow in addBinding
    (bsc#1275096)

  • CVE-2026-56405: libexpat before 2.8.2 has an integer overflow in
    getAttributeId (bsc#1275096)

  • CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in
    XML_ParseBuffer because it lacked a check that was present in XML_Parse (
    bsc#1275096)

  • CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog
    that is related to storeEntityValue and entity textLen (bsc#1275096)

  • CVE-2026-56408: libexpat before 2.8.2 has an integer overflow in copyString
    (bsc#1275096)

  • CVE-2026-56409: xmlwf in libexpat before 2.8.2 has an integer overflow for
    the output filename when -d outputDir is used (bsc#1275096)

  • CVE-2026-56410: xmlwf in libexpat before 2.8.2 has an integer overflow in
    resolveSystemId (bsc#1275096)

  • CVE-2026-56411: xmlwf in libexpat before 2.8.2 has an integer overflow in
    endDoctypeDecl via NOTATION declarations (bsc#1275096)

  • CVE-2026-56412: libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS
    in doCdataSection and thus lacks handler call depth tracking for various
    calls from within handlers in cases of a policy violation. Thus, a
    use-after-free can occur. This issue exists because of an incomplete fix
    for CVE-2026-50219 (bsc#1275096)

  • CVE-2026-41080: libexpat before 2.8.0 uses insufficient entropy, and thus
    hash flooding can occur via a crafted XML document (bsc#1262263)

  • CVE-2026-45186: libexpat before 2.8.1, the computational complexity of
    attribute name collision checks allows a denial of service via moderately
    sized crafted XML input (bsc#1264713)

  • CVE-2026-32776: libexpat before 2.7.5 allows a NULL pointer dereference
    with empty external parameter entity content (bsc#1259724)

  • CVE-2026-32777: libexpat before 2.7.5 allows an infinite loop while parsing
    DTD content (bsc#1259710)

  • CVE-2026-32778: libexpat before 2.7.5 allows a NULL pointer dereference in
    the function setContext on retry after an earlier ouf-of-memory condition (
    bsc#1259725)

  • CVE-2026-57585: Prior to 1.2.1, there is an Out-of-bounds read/crash on
    Unpacker reuse after a caught error potentially leading to a DoS attack (
    bsc#1269947)

  • CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a
    denial of service (bsc#1268683)

  • CVE-2025-50181: Pool managers now properly control redirects when retries
    is passed (GHSA-pq67-6m6q-mj2v (bsc#1244925)

  • CVE-2025-50182: Redirects are now controlled by urllib3 in the Node.js
    runtime (GHSA-48p4-8xcf-vxj5 (bsc#1244924)

  • CVE-2026-21441: Fix excessive resource consumption during decompression of
    data in HTTP redirect responses (bsc#1256331)

  • CVE-2025-66418: Fix resource exhaustion via unbounded number of links in
    the decompression chain (bsc#1254866)

  • CVE-2025-66471: Fix excessive resource consumption via decompression of
    highly compressed data in Streaming API (bsc#1254867)

Expanded Operating System Support

  • Enabled SLES 16.1 beta support.

  • RES8 client tools are now available for the ppc64le architecture.

  • SUSE Linux Enterprise Server 16.1 (aarch64): Added product support and
    channel definitions for SLES 16.1 with NVIDIA extensions on AArch64 (ARM64)
    architecture.

Improved Transactional System Management

Uyuni now provides clearer and more reliable handling of transactional systems,
such as SUSE Linux Enterprise Micro and openSUSE Leap Micro. Live and
transactional operations are now explicitly distinguished across states, remote
commands, formulas, events, and recurring actions, so you always know which
execution mode will be used on a transactional system.

Key improvements include accurate action progress reporting when a reboot is
required to activate a staged transactional change, a new Btrfs Snapshots tab
on the System Details page for viewing and refreshing snapshot information, and
configurable transactional policies for formulas.

For more information, see ManagingTransactional Systems.

Confidential Computing Attestation for IBM Z Series

Uyuni 2026.10 adds support for Confidential Computing (CoCo) Attestation on IBM
Z series (s390x) architecture.

This lets you verify that workloads are running in a trusted, confidential
execution environment, adding an extra layer of security for sensitive
workloads on IBM Z infrastructure.

New uyuni-tftpd Container

Since Uyuni 2026.08, the server is installed with TFTP disabled by default.
This change was not documented in the 5.2.0 release notes.

The TFTP service now runs in a separate container named uyuni-tftpd (with a
corresponding systemd service), utilizing the proxy-tftpd image. For new
installations, this is activated using --tftpd-enable. For upgrades, this
separate container is enabled automatically if the TFTP service was already
running on the server container.

Documentation Updates

Added an English-only edit link on the Uyuni documentation site, allowing
readers to directly propose changes to the English source files.

API Changes

Public 'cobbler_api' Endpoint

The cobbler_api XML-RPC endpoint is no longer reachable from outside the server
container; access is now restricted to localhost. This endpoint is only used
internally by Uyuni and was never intended to be exposed publicly.

Using Cobbler directly, outside of the Uyuni integration, is not supported. If
external access to cobbler_api is still required, create the following file
inside the server container at /etc/apache2/conf.d/zz-cobblerapi.conf:

<Location "/cobbler_api">
    Require all granted
</Location>

Monitoring stack

Prometheus upgraded to 3.13.4

Prometheus (golang-github-prometheus-prometheus) has been updated from version
3.5.4 to 3.13.4

Security fixes:

  • CVE-2026-84304: Bump google.golang.org/grpc to v1.83.1 to fix HTTP/2 DATA
    frame fragmentation memory exhaustion (bsc#1279203)

  • CVE-2026-84445: Bump google.golang.org/grpc to v1.83.1 to fix DoS via crash
    due to missing ':authority' and 'Host' headers (bsc#1278947)

  • CVE-2026-102278: Bump brace-expansion to fix uncontrolled recursion on
    nested brace groups (bsc#1283408)

  • CVE-2026-102277: Bump brace-expansion to fix quadratic-time expansion
    potentially leading to DoS (bsc#1283382)

  • CVE-2026-102276: Bump brace-expansion to fix arbitrary strings generation (
    bsc#1283194)

  • CVE-2026-17495: Bump moment to fix path traversal (bsc#1280774)

  • CVE-2026-84371: Bump sanitize-html to fix stored XSS due to possible SVG
    SMIL URI-list scheme-policy bypass (bsc#1279053)

  • CVE-2026-84373: Bump vitest to fix arbitrary file reads (bsc#1278265)

  • CVE-2026-69153: Bump postcss to prevent unauthorized access to map’s
    sources and sourcesContent (bsc#1276133)

  • CVE-2026-55685: Bump react-router to fix DoS via unauthenticated manifest
    endpoint requests (bsc#1273351)

  • CVE-2026-53669: Bump react-router to fix Open Redirect vulnerability via
    backslashes in navigation components (bsc#1273246)

  • CVE-2026-53550: Bump js-yaml to fix potential CPU exhaustion (bsc#1268848)

  • CVE-2026-63209: Bump github.com/klauspost/compress to v1.18.7 to fix
    integer overflow (bsc#1283678)

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating
    golang.org/x/net to version 0.57.0 (bsc#1266608)

  • CVE-2026-56852: Bump golang.org/x/text dependency to resolve regarding
    out-of-bounds read (bsc#1272102)

  • CVE-2026-44990: Resolve Cross-Site Scripting (XSS) vulnerability in the new
    React UI by properly sanitizing target labels (bsc#1275205)

  • CVE-2026-53606: Fix incomplete URI scheme validation in sanitize-html (bsc#
    1269966)

  • CVE-2026-37236: Bump github.com/grpc-ecosystem/grpc-gateway to version
    2.29.0 to fix bypassing established access control (bsc#1277957)

  • CVE-2026-41178: Bump go.opentelemetry.io/otel to version 1.44.0 to fix DoS
    via oversized inputs (bsc#1276653)

  • CVE-2026-45623: Bump postcss to version 8.5.14 to fix information
    disclosure and denial of service via crafted CSS input (bsc#1273229)

  • CVE-2026-33814: Bump golang.org/x/net to version 0.53.0 to fix infinite
    loop in HTTP/2 transport (bsc#1265766)

  • CVE-2026-2303: Drop vulnerable mongo-driver dependency (bsc#1269856)

  • CVE-2025-4673: HTTP clients stop forwarding credentials on redirects to
    prevent token leakage (bsc#1275206)

  • CVE-2023-45289:HTTP clients stop forwarding credentials on redirects to
    prevent token leakage (bsc#1275207)

  • Security: Reject snappy-compressed HTTP requests exceeding the 32MB decoded
    limit to prevent memory exhaustion and DoS attacks.

  • Security: Update grpc dependency to mitigate potential denial-of-service
    vulnerabilities.

Breaking Changes:

  • version 3.10.0: This affects scraping, remote read and write, alerting, and
    SD. Network paths might need adjustments to avoid redirects.

  • version 3.9.0: Rule group pagination tokens now use SHA-256 instead of MD5.
    Custom API consumers must adapt to the new longer token format.

  • version 3.8.0: promtool relative paths in config files now resolve relative
    to the config directory itself, instead of the current working directory.

  • version 3.7.0: Deprecated remote-write metrics like
    prometheus_remote_storage_samples_total are removed in favor of
    prometheus_wal_watcher_records_read_total.

For a complete list of changes, see the upstream changelogs

https://github.com/prometheus/prometheus/blob/main/CHANGELOG.md

Grafana upgraded to 12.4.11

Grafana has been updated from version 12.4.5 to 12.4.11:

Security fixes:

  • CVE-2026-15815: Fix Grafana Plugin extraction zip slip (bsc#1281451)

  • CVE-2026-76154: Fix Geomap MapLibre XSS (bsc#1281464)

  • CVE-2026-79656: Fix improper permission checking to prevent unauthorized
    privilege escalation (bsc#1283514)

  • CVE-2026-56855, CVE-2026-56854, CVE-2026-78662: Fix authentication bypass
    and deadlocks by bumping crypto/ssh library to version 0.56.0 (bsc#1278576)

  • CVE-2026-84445: Fix DoS via crash due to missing :authority and Host
    headers in gRPC-Go xDS servers by bumping google.golang.org/grpc to version
    1.83.2 (bsc#1278936)

  • CVE-2026-84304: Fix Heap Memory Exhaustion via HTTP/2 DATA Frame
    Fragmentation in gRPC-Go by bumping it to version 1.83.2 (bsc#1279204)

  • CVE-2026-84303: Fix xDS RBAC HTTP Filter bypass via mixed-case Header
    Matching and gRFC A41 validation evasion by bumping google.golang.org/grpc
    to version 1.83.2 (bsc#1279299)

  • CVE-2026-17183: Fix exposing data accessible through Grafana’s configured
    datasource credentials (bsc#1275934)

  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (
    bsc#1269841)

  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#
    1276426)

  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/
    kin-openapi (bsc#1276973)

  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)

  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (
    bsc#1278322)

  • CVE-2026-83530: Bump github.com/google/cel-go to version 0.31.0 to enforce
    expression size limit before source construction (bsc#1279990)

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating
    golang.org/x/net to version 0.57.0 (bsc#1266600)

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in
    golang.org/x/text/unicode/norm (bsc#1272008)

  • CVE-2026-41178: Fix opentelemetry-go’s baggage parsing (bsc#1276658)

Version 2026.08

Release notes cleanup

With Uyuni 2026.08, we are archiving the release notes of Uyuni versions older
than 2025.05 to make the document smaller and easier to navigate.

Release notes for older versions, from 2021.12 up to 2024.12, can still be
found at the website.

Monitoring

Grafana

Grafana has been updated from version 11.6.14+security04 to version 12.4.5 and
the new version provides several security fixes.

Breaking changes introduced in version 12.0.0:

   • Removed AngularJS and all deprecated UI Extensions APIs.

   • Enforced stricter version compatibility checks in plugin CLI install
     commands.

   • Enabled the failWrongDSUID feature flag by default, which rejects data
     sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5:

  • Added Legal-Review-Notice bsc#1271327.

  • Datasources: return 400 when payload UID does not match URL UID in PUT /api
    /datasources/uid/:uid.

  • Analytics: kept internal dashboard id.

  • Reporting: correctly apply appSubURL to report settings requests.

  • Alerting: documented Grafana HA Alertmanager cluster metrics prefix change.

  • Dependency updates to core plugins and UI libraries.

  • Updates to data source provisioning and dashboard schemas.

  • Introduced dynamic dashboards in public preview.

  • Added a new side toolbar that replaces the second top toolbar to provide
    additional vertical space.

  • Added the ability to create dashboards from templates using sample data.

  • Revamped the gauge visualization with rounded bars, configurable bar
    thickness, and endpoint markers.

  • Added support to map one variable to multiple values.

  • Released a completely redesigned logs visualization.

  • Added the ability to export dashboards directly as PNG images.

  • Introduced an interactive learning experience within the Grafana UI.

  • Added a Switch template variable type to quickly toggle between values in
    queries.

  • Added functionality to style table cells using CSS properties via the field
    cell option.

  • Added support for Entra Workload Identity to enhance authentication
    capabilities with federated credentials.

  • Redesigned the alert rule list page.

  • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.

  • Added support for Service Account Impersonation in the BigQuery data
    source.

  • Introduced the Grafana Advisor in public preview.

  • Introduced a new dashboard schema to replace the original single grid
    layout.

  • MIGRATION: Triggered a full-table rewrite for the annotation table, which
    may temporarily increase disk usage.

Check the upstream changelog for all the details.

Ubuntu 26.04 Support

Uyuni 2026.08 expands its list of supported operating systems with full
management support for Ubuntu 26.04 LTS clients. With this update,
administrators can manage Ubuntu 26.04 LTS systems directly from Uyuni 2026.08,
ensuring compliance, security, and consistency across all managed systems.

For detailed instructions on registering and managing Ubuntu clients, refer to
the client registration and supported features sections in the documentation.

openSUSE Leap 15.6 and openSUSE Leap Micro 5.X End-of-Life Notice

openSUSE Leap 15.6 reached end of life on April 30, 2026.

The Uyuni client tools supporting openSUSE Leap 15.X have been used also for
openSUSE Leap Micro 5.X and, in an upcomig Uyuni release the support for those
client tools will be removed.

 Administrators are strongly encouraged to migrate openSUSE Leap 15.6 clients
 to openSUSE Leap 16.0 so they can continue receiving security updates for the
 operating system.

Security Fixes

This update addresses important security vulnerabilities. We recommend
upgrading your Uyuni instances as soon as possible.

  • CVE-2026-33382 - bsc#1271331 - Grafana: Limited the size of request bodies
    processed by several Grafana API endpoints.

  • CVE-2025-12141 - bsc#1262187 - Grafana: Fixed an information leakage issue
    in Grafana Alerting.

  • CVE-2026-41607 - bsc#1263272 - Grafana: Fixed a potential information
    disclosure issue in Apache Thrift used by Grafana.

  • CVE-2026-8595 - bsc#1271557 - Grafana: Fixed Stored Cross-Site Scripting
    via malicious dashboard field name.

  • CVE-2026-42127 - bsc#1268868 - Grafana: Fixed Denial Of Service through
    memory exhaustion in grafana’s public dashboard query endpoint.

  • CVE-2026-9029 - bsc#1272328 - Grafana : Fixed arbitrary code execution and
    information disclosure via Cross-Site Scripting in geomap panel.

  • CVE-2026-39882 - bsc#1274217 - Grafana: Prevent memory exhaustion DoS in
    OpenTelemetry OTLP HTTP exporters by updating to v1.43.0.

  • CVE-2026-39882 - bsc#1274221 - Prometheus: Fixed unbounded HTTP response
    body reads by updating OpenTelemetry to version 1.43.0.

  • CVE-2026-33244 - bsc#1267416 - Prometheus: Fixed improper neutralization of
    the HTTP Location header value in React Router.

  • CVE-2026-13149 - bsc#1269917 - Prometheus: Prevented a potential
    denial-of-service by updating brace-expansion to version 5.0.7.

  • CVE-2026-33814 - bsc#1265827 - Prometheus: Fixed an infinite loop in the
    HTTP/2 transport implementation.

  • Prometheus: Improved the /-/config endpoint in Prometheus STACKIT SD to
    prevent secrets from being exposed in plaintext.

Version 2026.06

Containers OS switched from openSUSE Leap 15.6 to openSUSE Leap 16.0

With 2026.06, as openSUSE Leap 15.6 was out of support for already some time,
the base OS that is now used to build our containers is openSUSE Leap 16.0.

openSUSE Leap 16.0 uses Python 3.13 by default. This Python version (and
probably other SSL clients) validates certificates strictly and rejects any CA
certificate that does not mark the X509v3 Basic Constraints extension as
critical.

Please refer to the Migrate SSL Certificate Authorities for detailed
instructions to migrate the SSL Certificate Authorities.

In addition, the bump of the container base to Leap 16.0 will trigger a
PostgreSQL reindexing, and this could take a long time. This is due to the
glibc upgrade from Leap 15.6 (glibc 2.38) to Leap 16.0 (glibc 2.40).

Upcoming Podman 6.0.0 and Breaking Changes

openSUSE Tumbleweed will soon receive an update to Podman 6.0.0. Please be
aware that this major release introduces a significant number of breaking
changes. While the required database migration to SQLite is handled
automatically by Podman in the background, we strongly urge all administrators
to review the upstream documentation to understand how these changes might
impact their specific setups. Users running Uyuni Server or Proxies on other
operating systems should also prepare for these updates as Podman 6.0.0
eventually lands in their distribution’s repositories.

For a complete list of breaking changes and technical details, please read the
official Podman 6.0.0 Release Notes.

Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0

Uyuni 2026.06 now supports in-place product migration of managed clients from
SUSE Linux Enterprise Server 15 SP7 to SUSE Linux Enterprise Server 16.0.
Administrators can perform the migration directly from the Uyuni web interface
or through the API.

 Unlike standard product migrations, upgrading from SUSE Linux Enterprise
 Server 15 SP7 to 16.0 is a two-step process. The migration action runs first,
 followed by a mandatory verification step to confirm that the upgrade
 completed successfully before the system is considered fully migrated.

 This Migration path is currently only supported for regular minions. For
 minions managed by Salt SSH, migration is not yet supported.

For more information, see the SUSE Linux Enterprise Server 16 Upgrade Guide.

Support for FIPS-Enabled Host OS

Uyuni 2026.06 can now be deployed on a FIPS-enabled host OS.

This allows organizations with strict cryptographic compliance requirements to
run Uyuni within a FIPS-enforced environment.

SUSE Liberty Linux 9.6 Support

Uyuni 2026.06 adds bootstrap repository definitions and product entries for
SUSE Liberty Linux 9.6 EMS (Extended Minor Version Support).

Administrators can now register and manage SUSE Liberty Linux 9.6 clients
directly from Uyuni.

Security Fixes

This update addresses security vulnerabilities. We recommend upgrading your
Uyuni instances as soon as possible.

  • CVE-2026-34986 - bsc#1262950 - Fixed panic in JWE decryption.

  • CVE-2026-41602 - bsc#1263501 - Apache Thrift: Integer overflow or
    wraparound vulnerability.

  • CVE-2026-39821 - bsc#1266600 bsc#1266556 - Fixed validation bypass and
    privilege escalation by updating golang.org/x/net to version 0.55.0.

  • CVE-2026-42198 - bsc#1264174 - postgresql-jdbc: Client-side Denial of
    Service via malicious SCRAM-SHA-256 authentication.

  • CVE-2022-21698 - bsc#1248699 - prometheus: Replaced github.com/prometheus/
    client_golang with version 1.11.1.

  • CVE-2026-40179 - bsc#1262222 - Prometheus: Fixed stored XSS via unescaped
    label values in old UI heatmap chart tick labels.

  • CVE-2026-42151 - bsc#1263986 - Prometheus: Fixed AzureAD remote write OAuth
    client_secret exposure in plaintext via /-/config endpoint.

  • CVE-2026-42154 - bsc#1263987 - Prometheus: Fixed remote-read accepting
    snappy-compressed requests whose declared decoded length exceeds the decode
    limit.

  • CVE-2026-28374 - bsc#1265290 - Grafana: Fixed insecure direct object
    reference in Annotations API.

  • CVE-2026-28376 - bsc#1265289 - Grafana: Fixed unbounded memory allocation
    in Grafana Live push endpoint.

  • CVE-2026-28379 - bsc#1265288 - Grafana: Fixed viewer-triggered race
    condition in Grafana Live.

  • CVE-2026-28380 - bsc#1265287 - Grafana: Fixed broken access control in
    Snapshot API.

  • CVE-2026-28383 - bsc#1265286 - Grafana: Fixed unbounded memory allocation
    in plugin resources.

  • CVE-2026-33376 - bsc#1265285 - Grafana: Fixed Auth Proxy IPv6 allowlist
    bypass.

  • CVE-2026-33377 - bsc#1265284 - Grafana: Fixed dashboard editor privilege
    escalation.

  • CVE-2026-33378 - bsc#1265283 - Grafana: Fixed out-of-memory exception in
    Data Source Plugin.

  • CVE-2026-33380 - bsc#1265282 - Grafana: Fixed SQL Expressions vulnerability
    allowing authenticated attackers to read arbitrary files from the server
    filesystem.

  • CVE-2026-33381 - bsc#1265281 - Grafana: Fixed service account token
    generation after permission removal.

  • bsc#1269253 - spacewalk-java: formula.setFormulasOfGroup and
    formula.getCombinedFormulaDataByServerIds allow cross-organization broken
    access control.

  • bsc#1269534 - spacewalk-java: Authenticated Arbitrary File Write via Image
    Upload Filename Traversal.

Debian 12 End-of-Life Notice

Debian 12 (Bookworm) reaches end of life on July 11th, 2026.

Uyuni will continue to support the management of Debian 12 clients for a
three-month grace period, until October 31, 2026.

 Administrators are strongly encouraged to migrate Debian 12 clients to Debian
 13 before end of life so they can continue receiving security updates from the
 Debian vendor.

SUSE Registry URL Change: Update Your Allowlist

The domain registry-store.suse.com was a temporary name used during the
migration of the SUSE registry infrastructure. The current and permanent domain
is registry-storage.suse.com.

 If your firewall or proxy allowlist includes registry-store.suse.com, update
 it to registry-storage.suse.com to ensure continued access to the SUSE
 registry. For the most up-to-date list of SUSE registry and SCC URLs required
 for firewall and proxy access, see the SUSE Customer Center and SUSE registry
 URLs.

Version 2026.04

Red Hat Enterprise Linux 10 Support

Uyuni introduces support for managing Red Hat Enterprise Linux 10 and its
compatible distributions, including SUSE Liberty Linux 10, AlmaLinux 10, Oracle
Linux 10 and Rocky Linux 10. This enables organizations running mixed
enterprise Linux environments to manage all their systems through a single,
unified platform using consistent tools and workflows.

 Red Hat Enterprise Linux 10 has raised the minimum supported x86-64
 microarchitecture baseline to x86-64-v3. Systems running on x86-64-v1 or
 x86-64-v2 CPUs cannot run RHEL 10 and will not be supported.

Online Database backup management with mgradm

Uyuni introduces online database backup management via mgradm, based on
postgresql continuous archiving (Write-Ahead Logging).

Administrators can manage the full backup lifecycle directly from the command
line, including creating base backups, monitoring backup status, rebasing,
restoring database content, and disabling backup management when needed.

Backups are stored in a dedicated Podman volume and are designed to reduce the
risk of data loss by continuously archiving database changes.

 Known issue: The storage volume needs to be created before the backup is
 enabled. Use the command: podman volume create var-pgsql-walbackup

 Only full recovery is supported. Point-in-time recovery currently requires a
 manual workflow.

For more information, refer to the Database Backup Management section in the
documentation.

Enhanced SCAP Auditing Integration (Technology Preview)

Uyuni introduces a modernized approach to SCAP (Security Content Automation
Protocol) auditing. The enhanced SCAP integration streamlines compliance
scanning by centralizing content management, introducing reusable policies,
supporting automated remediation, and eliminating the need to pre-stage SCAP
files on managed systems.

Key improvements include centralized SCAP content management, reusable scan
policies, automated remediation support, and recurring scan scheduling.

This feature is available as a Technology Preview and will be moved to a fully
supported state in a future release.

Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0

Uyuni supports migrating managed clients from SUSE Linux Enterprise Server 15
SP7 to SUSE Linux Enterprise Server 16.0 using the built-in product migration
feature. This enables administrators to seamlessly upgrade their managed
systems to the latest SUSE Linux Enterprise Server release directly from the
Uyuni web interface.

Reporting Dashboard for Grafana

Uyuni introduces a new reporting dashboard integrated with the existing Grafana
monitoring stack.

While the read-only reporting database continues to support third-party
visualization tools such as Metabase, this new dashboard provides a convenient
out-of-the-box option for viewing and filtering report data. Administrators can
leverage Grafana’s powerful visualization and filtering capabilities directly
within the existing monitoring infrastructure, eliminating the need to
configure additional tools.

Installation scripts merged with container images

Since the start of containerization, installation and configuration scripts
were part of our uyuni-tool’s mgradm utility. This release changes that and all
installation and upgrade scripts for both database and server are now part of
the images themselves. This concerns only scripts for actual server and
database. Other scripts and responsibilities, such as creating systemd entries,
self-signed certificates and major db upgrades, are still done by the mgradm
tool.

This change allows for Podman and Kubernetes versions to have identical
configurations and opens further possibilities in the future.

New API Endpoint: listMigrationTargetsWithChannels

The new listMigrationTargetsWithChannels endpoint returns, for each migration
target, the standard base channel label and childs channels.

This allows API consumers to select the correct target base channel for use
with scheduleProductMigration in a single call.

Monitoring: Grafana

Grafana has been updated from version 11.6.11 to version 11.6.14+security-01

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v11.6.12

  • Grafana Release v11.6.13

  • Grafana Release v11.6.14

  • Grafana Release v11.6.14+security-01

Important Security Update

This update addresses several high-severity CVEs. We highly recommend upgrading
your Uyuni instances as soon as possible to ensure they remain secure. The
following CVEs are included in this release:

  • CVE-2026-26958 - bsc#1258595 - edwards25519: Bump filippo.io/edwards25519
    to version 1.1.1 to address security vulnerabilities.

  • CVE-2026-21725 - bsc#1258873 - grafana: Fix missing UID when deleting
    datasource by name.

  • CVE-2026-33375 - bsc#1260881 - grafana: Fix denial of Service via
    out-of-memory exhaustion in MSSQL data source plugin.

  • CVE-2026-27876 - bsc#1261025 - grafana: Fix remote arbitrary code execution
    via chained SQL Expressions.

  • CVE-2026-27877 - bsc#1261026 - grafana: Fix information disclosure of
    data-source passwords via public dashboards.

  • CVE-2026-28375 - bsc#1261029 - grafana: Fix denial of service via testdata
    data-source.

  • CVE-2026-27879 - bsc#1261027 - grafana: Fix denial of service via resample
    query.

  • CVE-2026-33186 - bsc#1260263 - grafana: Fix authorization bypass due to
    improper validation of the HTTP/2 :path pseudo-header.

  • CVE-2026-21724 - bsc#1260878 - grafana: Fix authorization bypass allows
    modification of protected webhook URLs.

  • CVE-2025-29923 - bsc#1259999 - grafana: Fix potential out of order
    responses when CLIENT SETINFO times out during connection establishment.

  • CVE-2022-21698 - bsc#1248707 -
    golang-github-QubitProducts-exporter_exporter: Denial of service using
    InstrumentHandlerCounter.

  • CVE-2022-21698 - bsc#1248699 - prometheus-postgres_exporter: Denial of
    service using InstrumentHandlerCounter.

  • CVE-2026-27459 - bsc#1259808 - venv-salt-minion(pyopenssl): large cookie
    value can lead to a buffer overflow

  • CVE-2026-27448 - bsc#1259804 - venv-salt-minion(pyopenssl): unhandled
    exception can result in connection not being cancelled

Version 2026.03

CVE Auditing with OVAL (tech preview)

Updated schema to improve performance. Changes made will remove existing OVAL
data upon migration. OVAL data will be resynced within the next 24h. If
immediate use of the feature is desired a manual oval-data-sync should be
performed.

New products enabled

  • Debian 13

Upgrade to Tomcat 11 and Hibernate 7

This release update Tomcat to version 11 and Hibernate to version 7. Together
with this a lot of Java packages were updated as well. This renewal of the
codebase was required due to EOL of the currently used versions.

Monitoring: Grafana

Grafana has been updated from version 11.5.10 to version 11.6.11

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v11.6.0

  • Grafana Release v11.6.1

  • Grafana Release v11.6.2

  • Grafana Release v11.6.3

  • Grafana Release v11.6.4

  • Grafana Release v11.6.5

  • Grafana Release v11.6.6

  • Grafana Release v11.6.7

  • Grafana Release v11.6.8

  • Grafana Release v11.6.9

  • Grafana Release v11.6.10

  • Grafana Release v11.6.11

Security fixes

  • CVE-2025-13465 prometheus: Bump lodash package to version 4.17.23 to fix
    prototype pollution vulnerability bsc#1257329

  • CVE-2025-61140 prometheus: jsonpath: the value function is vulnerable to
    prototype pollution bsc#1257442

  • CVE-2026-1615 prometheus: jsonpath: arbitrary code injection due to unsafe
    evaluation of user-supplied JSON Path expressions bsc#1257897

  • CVE-2026-25547 prometheus: Fix unbounded brace range expansion leading to
    excessive CPU and memory consumption bsc#1257841

  • CVE-2026-21720 grafana: Fix unauthenticated DoS bsc#1257349

  • CVE-2026-21721 grafana: Fix access control by the dashboard permissions API
    bsc#1257337

  • CVE-2025-3415 grafana: exposure of DingDing alerting integration URL to
    Viewer level users bsc#1245302

  • CVE-2026-21722 grafana: Public dashboards annotations: use dashboard
    timerange if time selection disabled bsc#1258136

  • CVE-2024-29371 jose4j: Safeguard against excessive resource utilization by
    restricting the size of data during JWE payload decompression (bsc#1255298)

  • CVE-2026-27727 mchange-commons: Possible download and execution of
    malicious code triggered by reading a maliciously crafted
    javax.naming.Reference or serialized object. (bsc#1258913)

  • CVE-2026-27830 c3p0: Deserialization vulnerability through maliciously
    crafted Java serialized objects and javax.naming.Reference instances (bsc#
    1258942)

Monitoring Server Components for SLES 12 Client Tools

Starting with Uyuni 2026.03, the monitoring server related packages included in
the SLES 12 client tools channels have been removed and will no longer receive
updates. These packages previously enabled a SLES 12 system to act as a
monitoring server and included components such as Prometheus, Alertmanager,
Grafana, and related dashboards.

Client side monitoring components (exporters) will continue to be provided,
allowing SLES 12 systems to remain monitored by an external monitoring server.

Version 2026.01

New products enabled

  • SUSE Linux Enterprise Server 15 SP6 LTSS

  • SUSE Linux Enterprise Server 16

  • SL Micro 6.2

openSUSE Leap 16.0 Support

Uyuni also introduces support for managing openSUSE Leap 16.0 systems. This
enables administrators and developers to manage community-driven environments
using the same tools and workflows as enterprise platforms, making openSUSE
Leap 16.0 well suited for development, testing, and mixed environments.

For detailed instructions on registering and managing these clients, refer to
the Registration section in the documentation.

UI Support for Ansible Playbook Variables

Uyuni introduces the ability to edit Ansible playbook variables directly in the
Web UI. This feature allows a single playbook to be executed dynamically across
multiple systems by customizing variable values at runtime, eliminating the
need to modify the source playbook.

The Web UI now generates input fields based on the variables defined in a
playbook. When selecting a playbook under System > Ansible > Playbooks,
administrators can provide system-specific values immediately before execution,
making it easier to reuse playbooks for different configurations.

Role-Based Access Control (RBAC) Configuration via Web UI

Administrators can now manage Role-Based Access Control (RBAC) directly through
the Web UI. Previously, these tasks required direct API interaction.

This enhancement simplifies the management of User Access Groups and policies,
providing an intuitive interface to utilize the fine-grained access control
features introduced in Uyuni 2026.01.

Monitoring: Prometheus upgraded to 2.53.4

Prometheus golang-github-prometheus-prometheus has been upgraded from version
version 2.53.4 to next LTS version 3.5.0. The update includes number of
enhancements and bug fixes.

Check the upstream changelogs for more details:

  • https://github.com/prometheus/prometheus/releases/tag/v3.5.0

Containerized BIND and DHCP Support

Uyuni introduces support for containerized deployments of BIND and DHCP
services on branch servers.

  • The BIND formula configures the Domain Name System (DNS) service.

  • The DHCP formula configures the DHCP (Kea) service.

By default, these formulas pull container images from registry.suse.com.

Security fixes

Authentication protocol downgrade fix

A vulnerability (CVE-2025-62349) that allowed Salt minions to bypass security
checks by downgrading the authentication protocol has been fixed. A new
configuration option, minimum_auth_version, has been introduced to enforce the
minimum supported authentication protocol version. The default is 3 in salt
3006.x.

This prevents downgrade attacks and ensures that only minions using secure
authentication protocols can connect.

 The new default (minimum_auth_version: 3) blocks older minions that use
 protocol versions lower than 3. Such minions will fail to connect with errors
 similar to:

 Rejected authentication attempt using protocol version 1 (minimum required: 3)`

 If your deployment contains older minions, you must temporarily set the
 following in the master configuration before upgrading the master, then restart
 the master service

 minimum_auth_version: 0

 After the upgrade, when feasible and once you are able to upgrade all minions
 to the latest version provided by Uyuni, remove the temporary override from the
 master configuration.

Besides this CVE-2025-62349, this update also fixes CVE-2025-62348 and few
other security related issues around tornado.

Other security fixes

This update comes with number of security fixes

  • CVE-2025-67724 python-tornado: Missing validation of supplied reason phrase
    bsc#1254903

  • CVE-2025-67725 python-tornado: Fix DoS via malicious HTTP request bsc#
    1254905

  • CVE-2025-67726 python-tornado: Fix HTTP header parameter parsing algorithm
    bsc#1254904

  • CVE-2025-68156 grafana: Fix potential DoS via unbounded recursion in
    builtin functions bsc#1255340

  • CVE-2025-12816 prometheus Interpretation conflict vulnerability allowing
    bypassing cryptographic verifications bsc#1255588

Database image updated to PostgreSQL 18

With this Uyuni release we update the database container to support PostgreSQL
18. This also means that an upgrade will trigger a database migration.

 This change requires Uyuni version 2025.05 as the minimal Uyuni version to
 upgrade from.

mgradm migrate deprecation

Starting with Uyuni 2026.01, mgradm migrate subcommand has been deprecated. The
migrate command is not needed for Uyuni as it uses a rolling release model.

Ubuntu 20.04 End of Life

Ubuntu 20.04 was End of Life on May 31st, 2025.

After a grace period of more than 3 months, Uyuni will stop support for this
operating system after Uyuni 2026.01.

While existing client tools repositories will not be removed, they will not get
updates.

As for the code, it will not be broken on purpose, but it will not get tested
for Ubuntu 20.04 anymore.

All remaining users with Ubuntu 20.04 systems are encouraged to migrate to
Ubuntu 22.04 or Ubuntu 24.04 as soon as possible.

Version 2025.10

Critical Vulnerabilities Addressed

This release addresses a few high-severity CVEs. These vulnerabilities could
pose significant security risks if not addressed.

  • CVE-2025-53883: spacewalk-java: various XSS found on search page (bsc#
    1246439)

  • CVE-2025-53880: susemanager-tftpsync-recv: arbitrary file creation and
    deletion due to path traversal (bsc#1246277)

Considering that the affected one was only legacy code not used anymore in
Uyuni, from the server-image it was decided to remove susemanager-tftpsync, and
from the proxy-httpd-image the removed package was susemanager-tftpsync-recv.

In addition, another security issue worth mentioning:

  • spacecmd, susemanager, rhnlib and spacewalk-backend: usage of unsafe third
    party library for XML (bsc#1227577)

Validated host OS switched from openSUSE Leap Micro 5.5 to openSUSE Tumbleweed

With 2025.10, as previously decided by the community, and as openSUSE Leap
Micro 5.5 was out of support for already some time, the base OS that is now
validated is openSUSE Tumbleweed. Of course, this does not mean that any
Community member is forced to run Uyuni on this OS, rather only that this is
the version that was internally tested. We would be glad to hear feedback from
the Community using a different host OS, and will try our best to fix any issue
showing up on any other version.

To perform the migration from openSUSE Leap Micro 5.5, please check the Migrate
Uyuni Server from openSUSE Leap Micro 5.5 to Tumbleweed section of the
documentation.

openSUSE Tumbleweed as client

Uyuni 2025.10 now supports managing openSUSE Tumbleweed as client.

For details on the registration process, please refer to the Registration
section. To learn more about supported features, consult the Supported Features
section in our documentation.

Bulk Product Migration via System Set Manager

It is now possible to schedule product migrations directly from the web UI for
multiple servers at once using the System Set Manager. This streamlines
large-scale migrations by allowing administrators to plan and execute them in a
single step.

Generate and Upload Support Data from the UI

This new feature allows administrators to generate a support data archive for a
system directly from the web UI and upload it to SUSE Customer Center. This
simplifies the process of providing support information for troubleshooting.

Container-Based KIWI Image Build Support

Uyuni 2025.10 introduces a container-based KIWI image build system, in addition
to the existing legacy KIWI and KIWI NG tools.

The build system used depends on the underlying OS or specific pillar values:

  • SLE 11 / SLE 12 → legacy KIWI v7

  • SLE 15 → KiwiNG (v9 and containerized KIWI 10)

Administrators can override the default behavior using the following pillar or
custom values:

  • use_kiwi_ng → force the use of KIWI 9

  • use_kiwi_container → force the use of containerized KIWI 10

This release also allows all SUSE family OSes to become build hosts, that means
openSUSE Leap and openSUSE Tumbleweed as well. Those will automatically use
containerized KIWI.

Removal of POS_Image-RPi-Bootstrap and pxe-yomi-image-opensuse15

The images POS_Image-RPi-Bootstrap and pxe-yomi-image-opensuse15 were not
really in use, and as they were having build failures and no reports had ever
been received about them, it was simply decided to drop them.

Uyuni API version upgrade and breaking changes

Due to the changes introduced in this version, the Uyuni Documentation API has
been upgraded from version 28 to 29.

For the XMLRPC API, some standard exceptions are now FaultException, and some
were renamed:

  • ContentSyncException ⇒ ContentSyncException as FaultException

  • BadParameterException ⇒ InvalidParameterException

  • FileNotFoundException ⇒ IOFaultException

  • DuplicateProfileNameException ⇒ DuplicateProfileNameException as
    FaultException

  • LookupException ⇒ PermissionCheckFailureException

  • PermissionException ⇒ PermissionCheckFailureException

  • IllegalArgumentException ⇒ InvalidParameterException

  • IllegalStateException ⇒ InvalidArgsException

These can be considered breaking changes as when some of these exceptions are
expected to be caught, different ones are now received instead, and the
handling will not work anymore.

For Rest-like-API it might not be considered a breaking change, as there are no
exceptions but error codes.

For further details about the API, please refer to the Uyuni API Documentation.

Version 2025.07

Important Salt Security Update

This update includes some critical fixes for Salt. The following CVE fixes are
part of this release:

  • CVE-2024-38824 - bsc#1244565

  • CVE-2025-22239 - bsc#1244574

  • CVE-2025-22236 - bsc#1244568

  • CVE-2025-22237 - bsc#1244571

  • CVE-2024-38825 - bsc#1244566

  • CVE-2025-22240 - bsc#1244567

  • CVE-2024-38823 - bsc#1244564

  • CVE-2025-22241 - bsc#1244570

  • CVE-2025-22238 - bsc#1244572

  • CVE-2025-22242 - bsc#1244575

  • CVE-2024-38822 - bsc#1244561

 These CVEs affect both the Salt master and the minions. Some of these
 vulnerabilities are very critical and could pose significant security risks if
 not addressed. User must upgrade both the Salt master and the minions to
 ensure their environment is protected.

 As always, the Salt master must be upgraded before upgrading the minions. This
 is especially important in this case to prevent exceptions or errors on the
 minions if the master has not been updated first.

Important Security Updates

This update includes some critical fixes for Uyuni Server. The following CVE
fixes are part of this release:

  • CVE-2025-46811 - bsc#1246119

  • CVE-2025-46809 - bsc#1245005

Version 2025.05

Separate Database Container

Uyuni 2025.05 now includes the PostgreSQL database in a separate container. As
this new database container no longer shares the SSL certificate with the web
server, the password of the SSL CA key is required when upgrading from any
older version. When using third party certificates, a certificate and key for
the database will need to be provided instead.

To help with backing up and restoring the data a new tool mgradm backup command
is available, more information about it can be found in the Backup and restore
section of the documentation.

Please check the list of containers for further reference.

Role-Based Access Control (RBAC) Implementation

Uyuni 2025.05 now supports Role-Based Access Control (RBAC) to provide users
with fine-grained access control and configuration options. This enhancement
centralizes access control rules, making them easier to manage and adapt. The
implementation is designed to be flexible, allowing new use cases and rules to
be defined through configuration rather than code changes. The Uyuni Server
will include sensible default policies while also enabling users to create
custom access policies (user access groups) to suit their specific
requirements.

The Uyuni Server has this feature enabled by default, and includes sensible
default policies while also enabling users to create custom access policies
(user access groups) to suit their specific requirements.

Online Synchronization for Hub and Peripheral Servers

Uyuni 2025.05 introduces a new online synchronization mechanism between the Hub
and peripheral servers, providing a more user-friendly and automated approach
to content synchronization. This enhancement leverages existing stable
mechanisms to deliver a robust and efficient solution and significantly
improves both performance and the overall user experience. With the Hub
architecture, centralized content management is now seamlessly extended to
peripheral servers.

The new 'Hub online synchronization' feature builds on the existing repository
synchronization mechanism. It allows peripheral servers to sync their software
channels directly from repositories hosted on the Hub server. Once the
connection is established, the Hub becomes the primary content source for its
connected peripheral servers.

Currently, this functionality is limited to software channels, but future
releases will expand support to include other artifacts such as images and
configuration channels.

As part of this improvement, the already deprecated ISSv1 will be removed.
ISSv2 will remain available for offline synchronization scenarios.

Ansible Integration Enhancements

Uyuni 2025.05 includes a range of enhancements to its Ansible integration,
making it easier to manage automation workflows directly from within the
product. These improvements aim to streamline day-to-day operations and
increase visibility and control over Ansible-driven configurations.

Key improvements include:

  • Display of raw Ansible playbook output in the event history of the control
    node, along with a list of all targeted systems.

  • Support for recurrent (scheduled) execution of Ansible playbooks.

  • Ability to configure default playbook and inventory paths when adding a new
    control node

  • New filter option in the system list to easily identify Ansible-managed
    systems onboarded

These enhancements mark a major step forward in improving Ansible usability and
integration in Uyuni.

Backup and Restore Support

Uyuni 2025.05 introduces a built-in backup and restore solution via the mgradm
backup command-line tool. It provides a reliable and consistent way to
safeguard your Uyuni installation, simplifying disaster recovery and system
migration.

The mgradm backup create command performs a full backup of all critical data,
while mgradm backup restore enables system recovery. Additional subcommands and
options are available and can be viewed using the tool’s help output.

Regular use of this tool is recommended to prevent data loss and ensure quick
recovery in case of failure.

 This approach may require substantial disk space and time to complete,
 depending on the size of your environment.

SUSE Linux Micro 6.1 support as client

Uyuni 2025.05 now supports managing SUSE Linux Micro 6.1 as client.

For more information about the registration process, refer to the Registration
section, and for more information about supported features, consult the
Supported Features.

SUSE Linux Enterprise 15 SP7 family as clients

Uyuni 2025.05 now supports managing SUSE Linux Enterprise 15 SP7 family as
clients.

For details on the registration process, please refer to the Registration
section. To learn more about supported features, consult the Supported Features
section in our documentation.

Add MAC based terminal naming option

Uyuni now allows users to configure Minion registration to use a MAC address
instead of HW-TYPE-MACHINE-ID during the setup of Uyuni for Retail.

By using the MAC address in the registration string, each machine becomes
uniquely identifiable, reducing confusion in scenarios such as network or boot
issues, where multiple entries for the same hardware might have previously
occurred.

This enhancement improves clarity and simplifies hardware identification and
management within Uyuni for Retail environments.

POS image templates updates

Following updates have been made in the POS image templates

  • JeOS7 and Graphical7 templates can now be built also on SUSE Linux
    Enterprise 15 SP6 build host

  • JeOS7 and Graphical7 templates no longer silently ignore saltboot dracut
    module installation failure

RPMs including the container images in Uyuni

As an effort to support air-gapped environments, Uyuni now includes RPMs with
the different images, for both Server and Proxy.

For further reference, please check the documentation in the section Air-gapped
Deployment

Health Check Tool

Uyuni 2025.05 comes with a standalone Health Check tool. This tool provides a
detailed dashboard, metrics, and logs from the server, showcasing its current
health status based on the support-config. Users can efficiently evaluate the
health of their running instance and identify any potential errors for
effective troubleshooting.

Improved CVE Audit with OVAL Data (Technology Preview)

The CVE Audit feature in Uyuni has traditionally relied on patch metadata from
channels to identify affected systems.

With this release, Uyuni introduces a new and improved CVE Audit mechanism
based on OVAL (Open Vulnerability and Assessment Language) data. This new
approach allows for more precise and accurate vulnerability assessments by
evaluating system packages directly against OVAL definitions.

This feature is currently released as a Technology Preview. Users can begin
testing the OVAL-based CVE Audit to gain better insights into their systems'
exposure to known vulnerabilities.

 This enhancement is disabled by default. Users can manually enable it to try
 the new functionality. If any issues arise, the system can easily revert to
 the previous patch-based CVE Audit by changing the relevant configuration
 setting.

For more information, see Oval section.

Password Policy Enforcement for New Users

In previous versions, Uyuni did not support password policy enforcement.
Administrators could set any password for users, regardless of complexity.

With this release, administrators can now define and enforce password policies
for Uyuni users. Once configured, the system ensures that all newly created
user passwords adhere to the specified rules.

This helps organizations comply with internal security standards and improve
overall password security.

 Existing user accounts are not affected retroactively. This enforcement
 applies only to newly created user accounts. Users are encouraged to review
 and adjust their password policy settings under the Admin section to match
 their organization’s security needs.

Product Migration Enhancement

The product migration feature has been enhanced, allowing users to seamlessly
migrate their SUSE Linux Enterprise Server systems to SUSE Linux Enterprise
Server for SAP when needed. This improvement significantly enhances the user
experience, eliminating the need for specific scripts previously required, as
it is now integrated into Uyuni’s capabilities.

Uyuni Documentation API changes

Due to the changes introduced in this version, the Uyuni Documentation API has
been upgraded from version 27 to 28.

This version removes the deprecated method synchronizeChannels from
sync.content

For further details about the API, please refer to the Uyuni API Documentation.

Monitoring

Grafana

Grafana has been updated from version 10.4.13 to version 11.5.5, including
breaking changes. The following CVEs have been addressed:

  • CVE-2025-22872

  • CVE-2025-3580

  • CVE-2025-3454

  • CVE-2025-2703

  • CVE-2025-22870

  • CVE-2024-9476

  • CVE-2024-9264

  • CVE-2023-45288

  • CVE-2025-4123

  • CVE-2025-27144

  • CVE-2024-51744

  • CVE-2024-45339

  • CVE-2024-11741

  • CVE-2024-45337

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v10.4.14

  • Grafana Release v10.4.15

  • Grafana Release v11.0.0

  • Grafana Release v11.0.1

  • Grafana Release v11.1.0

  • Grafana Release v11.1.1

  • Grafana Release v11.1.3

  • Grafana Release v11.1.4

  • Grafana Release v11.1.5

  • Grafana Release v11.2.0

  • Grafana Release v11.2.1

  • Grafana Release v11.2.2

  • Grafana Release v11.3.0

  • Grafana Release v11.3.1

  • Grafana Release v11.4.0

  • Grafana Release v11.4.1

  • Grafana Release v11.5.0

  • Grafana Release v11.5.1

  • Grafana Release v11.5.2

  • Grafana Release v11.5.3

  • Grafana Release v11.5.4

  • Grafana Release v11.5.5

Node exporter upgraded to 1.9.1

With Uyuni 2025.05, golang-github-prometheus-node_exporter has been updated
from version 1.7.0 to version 1.9.1, with no breaking changes.

Check the upstream changelogs for more details (including some release upgrades
not previously mentioned in the release notes):

  • https://github.com/prometheus/node_exporter/releases/tag/v1.9.1

  • https://github.com/prometheus/node_exporter/releases/tag/v1.9.0

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.2

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.1

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.0

The following CVEs have been addressed:

  • CVE-2025-22870: Matching of hosts against proxy patterns can improperly
    treat an IPv6 zone ID as a hostname component

  • CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary
    amounts of header data by sending an excessive number of CONTINUATION
    frames

Prometheus upgraded to 2.53.4

Prometheus golang-github-prometheus-prometheus has been upgraded from version
2.45.6 to version 2.53.4. The update includes number of enhancements and bug
fixes.

This upgrade also includes the fix for the following CVEs:

  • CVE-2023-45288

  • CVE-2025-22870

  • CVE-2024-51744

Check the upstream changelogs for more details:

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.4

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.3

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.52.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.50.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.50.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.49.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.49.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.48.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.48.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.46.0

Prometheus Alertmanager

Prometheus golang-github-prometheus-alertmanager has been patched to include
the fix for the following CVEs:

  • CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http

  • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs

Blackbox exporter

Prometheus prometheus-blackbox_exporter has been updated from version 0.24.0 to
version 0.26.0.

Check the upstream changelogs for more details:

  • https://github.com/prometheus/blackbox_exporter/releases/tag/v0.26.0

  • https://github.com/prometheus/blackbox_exporter/releases/tag/v0.25.0

The fixes for the following CVEs have been included:

  • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs

  • CVE-2023-45288: Fix closing connections when receiving too many

Removed features

Virtualization

The virtualization feature, deprecated in Uyuni 2024.07, has been fully removed
in version 2025.05. If you still rely on VM management functionalities, we
highly recommend considering alternatives like https://harvesterhci.io/.

ISSv1

Starting with the Uyuni 2025.05 release, ISSv1 has been fully removed,
following its deprecation in previous releases. For offline inter-server
synchronization, ISSv2 is now available. For online synchronization, the
required functionality is fully integrated into the Hub server. If you
encounter any gaps or issues during this transition, please don’t hesitate to
contact us for assistance.

Deprecated features

Legacy SCAP Scan API Endpoints

The Enhanced SCAP Auditing Integration is still available as a Technology
Preview in Uyuni 2026.10 and is planned to become generally available in the
next Uyuni release. Ahead of that change, the following legacy system.scap API
endpoints, which rely on pre-staging XCCDF/OVAL files on managed systems, are
now deprecated and will be removed once the new SCAP integration becomes
generally available:

  • system.scap.scheduleXccdfScan(sids, xccdfPath, oscapParams)

  • system.scap.scheduleXccdfScan(sids, xccdfPath, oscapParams, date)

  • system.scap.scheduleXccdfScan(sids, xccdfPath, oscapParams, ovalFiles,
    date)

  • system.scap.scheduleXccdfScan(sid, xccdfPath, oscapParams)

  • system.scap.scheduleXccdfScan(sid, xccdfPath, oscapParams, date)

Users of these endpoints should migrate to the Technology Preview policy-based
or custom scan endpoints instead:

  • system.scap.scheduleBetaXccdfScanWithPolicy(sids, policyId, date)

  • system.scap.scheduleBetaXccdfScanCustom(sids, params, date)

Once the Enhanced SCAP Auditing Integration becomes generally available, these
two methods will be renamed to system.scap.scheduleXccdfScanWithPolicy and
system.scap.scheduleXccdfScanCustom, and will no longer require beta features
to be enabled.

Changes to Debian and Ubuntu Monitoring Exporters

Monitoring exporters are no longer included with the Debian and Ubuntu Uyuni
Client Tools. Going forward, please install the required exporters directly
from your distribution’s standard repositories (such as the 'main' or
'universe' channels).

Prometheus exporters for RHEL and Clones

Effective with Uyuni 2026.06, all Prometheus exporters provided in the RHEL and
clone client tools, with the exception of the Node Exporter
(golang-github-prometheus-node_exporter) are deprecated and scheduled for
removal in a future release.

Users who require these exporters on client systems should obtain them directly
from their respective upstream vendors.

smdba tool

Starting with Uyuni 2025.05, the smdba tool has been deprecated. Alternative
solutions for backup, restore, and database tuning will be provided, with the
new tool mgradm backup being available now.

'spacewalk-manage-channel-lifecycle' has been deprecated

In previous releases, the spacewalk-clone-by-date tool was deprecated in favor
of Content Lifecycle Management (CLM), a more powerful and flexible solution.

We are now also deprecating spacewalk-manage-channel-lifecycle, as CLM fully
covers the functionality of both tools.

CLM’s comprehensive API provides all key capabilities previously offered, and
we strongly recommend migrating existing workflows and scripts to CLM.

Known issues

Kernel and Kernel-Livepatch Errata split in SLE15 SP7

Kernel and kernel-livepatch errata for SUSE Linux Enterprise Server 15 SP7 have
been split. Because the previous, combined errata had to be removed from the
vendor channels and re-synced, some manual steps are required to get the new
errata into your environment.

After the container upgrade, an automated product refresh with repo-sync is
triggered, which brings the new errata into the vendor channels. However:

  • Content Lifecycle Management (CLM) projects keep using the old errata until
    they are rebuilt and promoted. You must build and promote your CLM projects
    to pick up the new errata.

  • Manually cloned channels are not updated automatically. For each cloned
    live-patching channel, go to Software > Manage > Channels, select the
    channel, and click Update Channel. This looks up the values from the
    original channel and aligns them.

For Hub deployments, update the Hub container first. Only after the repo-sync
has finished and the metadata has been regenerated on the Hub, update the
container of the peripheral server(s).

 If an unpatched peripheral server synchronizes from an already-patched Hub,
 the peripheral will still show the old errata until it is patched as well.
 This is expected until the peripheral server’s own container is updated.

Container Healthcheck may report Failure on slow startups

The startup healthcheck for the server and database containers has been
improved and now succeeds as long as all services start within 10 minutes,
which covers all supported deployments meeting the minimum hardware
requirements.

On systems where startup takes longer than 10 minutes, the healthcheck may
still report a failure. If you encounter this, please report it, as it should
not occur on supported hardware. In the meantime, you can work around it:

  • Disable the healthcheck by editing /etc/systemd/system/
    uyuni-server.service.d/custom.conf or /etc/systemd/system/
    uyuni-db.service.d/custom.conf and setting:

    Environment="PODMAN_EXTRA_ARGS=--health-on-failure=none"

  • Or increase the healthcheck timeouts instead (--health-cmd must also be
    specified, otherwise the other options are ignored):

    Environment="PODMAN_EXTRA_ARGS=--health-cmd=/usr/bin/healthcheck.sh --health-start-period=900s --health-timeout=120s"

The currently active setting can be inspected with podman inspect <id>.

Salt’s ansible module broken by upstream bug in google.cloud collection

When running ansible-doc --list --type=module on openSUSE Tumbleweed with
ansible-14.5.0-1.1.noarch and the google.cloud collection version 1.15.0, an
unexpected exception is thrown (AttributeError: '_AnsibleTaggedDict' object has
no attribute 'strip').

This is caused by an upstream commit that incorrectly changed the file’s
documentation string. This failure in ansible-doc breaks Salt’s ansible module.
In Uyuni, this manifests as an error stating Error when executing salt state:
'ansible.discover_playbooks' is not available. when attempting to display or
interact with Ansible playbooks and inventories in the Web UI.

Workaround: Until the upstream issue is resolved, it is recommended to either
temporarily revert the commit or create a patch file that removes the changes
to the module’s docstring (lines 146-227).

This issue is being tracked upstream at https://github.com/ansible-collections/
google.cloud/issues/789.

Availability of Salt’s "virt" module inside the Salt Bundle

For openSUSE Leap, Tumbleweed and SLE family, the Salt Bundle provides the
necessary Python libvirt libraries for the Salt’s virt module to work, but it
requires the libvirt-libs package to be installed. This package must be
installed manually by the user in the managed client where we want to interact
with the virt module of Salt. Otherwise you would get an issue when interacting
with the module:

# venv-salt-call virt.all_capabilities
[...]
'virt' __virtual__ returned False: Unable to locate or import python libvirt library.

SSH SFTP Misconfiguration after SLES 16 Migration

Migrating systems from SUSE Linux Enterprise Server 15 SP7 to SUSE Linux
Enterprise Server 16 or from openSUSE Leap 15.6 to openSUSE Leap 16.0 can leave
an outdated SFTP subsystem path in /etc/ssh/sshd_config. This causes file
transfer protocols like scp and sftp to fail. A permanent automated fix will be
included in the next update.

Until the next update is released, please apply the following manual fix on
affected SLES 16 minions:

 1. Open /etc/ssh/sshd_config and locate the Subsystem sftp line.

 2. Change the path from /usr/lib/ssh/ to /usr/libexec/ssh/:

    - Subsystem      sftp    /usr/lib/ssh/sftp-server
    + Subsystem      sftp    /usr/libexec/ssh/sftp-server

 3. Restart the SSH daemon to apply the changes:

    systemctl restart sshd

Uyuni 2025.10 fails to start because of ERROR: column "server_id" of relation
"rhnactiondup" contains null values

This issue was first reported for the Enterprise product, SUSE Multi-Linux
Manager, in its version 5.1.1. The fix is however the same and it was explained
in this TID:

https://support.scc.suse.com/s/kb/
SUSE-Multi-Linux-Manager-5-1-1-fail-to-start-because-of-ERROR-column-server-id-of-relation-rhnactiondup-contains-null-values?
language=en_US

Hub XML-RPC Usage

To use the Hub XML-RPC API, users must manually assign the Peripheral Server
entitlement to peripheral servers. A fix is in progress, but for now this
manual step is required in order to use the Hub XML-RPC API.

Onboarding Salt-SSH Managed Clients

Onboarding Salt-SSH managed clients currently only works when performed by an
Uyuni administrator. This limitation will be addressed in the next milestone.

Reboot actions are not completed successfully

Scheduled reboot events are currently being detected, but their completion
status is not reported back. This issue is known and will be addressed in the
next milestone.

Bootstrapping issue

Bootstrap may occasionally fail with a "Minion is down" error. We are
investigating the issue, and a fix is expected in the next milestone.

Issues with the Database Container

Some issues remain unresolved in context of database container

  • Hostname renaming is not yet supported.

  • SSL certificate and CA rotation functionality is incomplete.

  • Disk space checks are currently non-functional

salt-secrets-config.service fails to start after a migration

This was reported with the release of Uyuni 2024.07, and will likely also
happen with 2024.08, the last RPM based version. Users should run the command:

zypper install spacewalk-backend-server

From within the options given, select the one to drop
spacewalk-backend-config-files-common, spacewalk-backend-config-files and
spacewalk-backend-config-files-tool

Node Exporter port 9100 conflicts with Traefik

Uyuni container uses port 9100 for Node Exporter. The same port is used by
Traefik default configuration to exports its own metrics, so there is a
conflict and Traefik fails to start:

2024/07/13 09:02:29 traefik.go:80: command traefik error: error while building entryPoint node-exporter: error preparing server: error opening listener: listen tcp :9100: bind: address already in use

The failure can be hidden because Kubernetes keeps running the Traefik with the
old configuration.

A fix to this issue will be available in the next Uyuni release.

Transactional systems - Salt SSH execution

The Salt SSH execution utilized during the onboarding process may face
inconsistencies if a Salt Minion or the Salt Bundle is already present on the
Minion, which could potentially result in onboarding failure.

Workaround: If the salt-minion or venv-salt-minion packages are already
installed, remove them, and then proceed to onboard the SUSE Linux Enterprise
Micro or openSUSE Leap Micro system.

Onboarding issues in SUSE Linux Enterprise Micro and openSUSE Leap Micro 5.5

There is a very specific case in which onboarding of the mentioned systems will
not work. This only happens when the package venv-salt-minion was already
installed on the target system. The issue is being investigated in order to
provide a fix. For the time being, our recommendation is to remove the affected
package first, and let the onboarding process reinstall it.

Database restart

If the Uyuni services are already running, they may not handle a PostgreSQL
database restart seamlessly. Restarting these services is necessary in such
cases. We are actively working on enhancing the resilience of these services to
recover gracefully in the event of a database restart.

If you encounter issues with Uyuni after a PostgreSQL restart, we recommend
restarting the Uyuni services using the command spacewalk-service restart.

AlmaLinux

Because of an upstream bug, the original package shipped with AlmaLinux 8.5 is
providing a broken repository file (containing duplicated identificators). We
have already reported this issue to AlmaLinux.

Workaround: Update the package almalinux-release before registering the
instance to Uyuni so at least the version 8.5-3 is installed.

Bootstrap with web UI using non-root user

Onboarding of clients with the non-root user from the Uyuni UI fails the
following error:

ERROR com.suse.manager.webui.controllers.utils.AbstractMinionBootstrapper - Error during bootstrap: SaltSSHError(13, stderr: "", stdout: "ERROR: Failure deploying ext_mods:"

The root cause of this problem is a wrong ownership of the Salt thin directory
when using the Salt bundle.

Workaround: Once bootstrap fails, the user can run chown -R $USER:$GROUP /var/
tmp/.*_salt once and try onboarding again, it shouldn’t fail this time.

CLM and custom repositories

When building a CLM project that includes custom channels with custom
repositories, the custom repositories might not be selected in the new cloned
custom channels. As a workaround, one can go to the new cloned custom channels,
select the custom repositories and synchronize them.

Container build host and Salt bundle

The container build host will not work with the Salt bundle. We are working on
a fix. Meanwhile, don’t use the Salt bundle on the Container build host but
rather a normal Salt.

Single Sign On, API and CLI tools

Single Sign On can be used to authenticate in the Web UI but not with the API
or CLI tools. This will be fixed in a future release of Uyuni.

EPEL and Salt packages

Using the Extra Packages for Enterprise Linux directly on RHEL clients (or
compatible: CentOS, Oracle Linux, etc) will install the Salt packages from
EPEL, which miss some features in the Uyuni-provided Salt packages. This is an
unsupported scenario.

If you need to enable the EPEL repository, make sure you are using the Salt
Bundle (it is used by default with new clients but not for clients onboarded
before Uyuni 2022.04)

Pay-as-you-go Connection requirement

For a fully operational PAYG Connection for SUSE Linux Enterprise Server or
SUSE Linux Enterprise Server for SAP Applications clients, it’s crucial to have
the instance-flavor-check tool installed, which is bundled within the
python-instance-billing-flavor-check package. While this package is
automatically installed on all newly created instances, for older running
instances, manual installation is necessary to prevent potential errors. If
you’re working with older Cloud instances, you can install this package
manually from the Public Cloud Module. For SUSE Linux Enterprise Micro 5.3 and
5.4, the instance-flavor-check is directly available and there’s no need to
enable extra modules.

RHEL native clients

When autogenerating bootstrap repositories for native RHEL clients, some errors
may be logged from the moment the official Red Hat channels are added until the
moment those channels are fully synchronized for the first time.

This does not affect CentOS, Rocky Linux, AlmaLinux or Oracle Linux.

Registering Spacewalk 2.x/Red Hat Satellite 5.x clients to Uyuni as Salt
minions

If a client machine is running the Red Hat Satellite 5.x agent, registering it
to Uyuni as a Salt minion will fail due to package conflicts.

Registering a RH Satellite 5.x client as a Uyuni traditional client works fine.

Registering a Uyuni traditional client as a Uyuni Salt minion will also work.

                Works                                Fails
RH Satellite 5.x ⇒ Uyuni traditional  RH Satellite 5.x ⇒ Uyuni Salt minion

Uyuni traditional ⇒ Uyuni Salt minion

In order to register Red Hat Satellite 5.x clients to Uyuni as Salt minions,
you will need to modify the bootstrap script to remove the Satellite agent
packages first.

Spacewalk 2.x and Oracle Spacewalk 2.x clients will show the same behavior as
Red Hat Satellite 5.x clients

Ubuntu/Debian: duplicate entries in sources.list

Due to a (bug) in the python3-apt package, a conflict arises with the signed-by
repository option. This issue stems from the interaction between the Salt
aptpkg module, which relies on the aptsources module provided by the python-apt
package.

Presently, the code only recognizes arch and trust options, while any other
valid options cause "aptsources" to classify the repository as invalid. This
can lead to duplicated entries in the /etc/apt/sources.list file on each
highstate run, potentially inflating its size significantly.

Although the patch has been submitted upstream, we are still awaiting its
official release.

In the meanwhile, please vist the SUSE Knowledgebase for more information about
the issue and possible workarounds that also apply to Uyuni.

Client Tools Notes

A quick overview of the URLs of the client tools is available at the following
link.

Supported clients

For an updated overview of supported clients and features please refer to the
official documentation.

Installation

Requirements

See the documentation for more details on the system requirements.

Installing the Server

See the Installation/Upgrade guide for detailed instructions on how to install.

Update from previous versions of Uyuni Server

See the Installation/Upgrade guide for detailed instructions on how to upgrade.

All connected clients will continue to run and are manageable unchanged.

Update from previous versions of Uyuni Proxy

When updating, always start with the server first and then continue with the
proxies.

See the release notes for the proxy and the Installation/Upgrade guide for
detailed upgrade instructions.

Other information

Red Hat Channels

Managing RHEL clients requires availability of appropriate Red Hat packages.

SUSE Channels

Managing SUSE Linux clients requires availability of appropriate SUSE channels.

Your licensed SUSE products can be used with Uyuni by following the setup
Wizard.

Check the manuals for more information.

Providing feedback

In case of encountering a bug please report it at https://github.com/
uyuni-project/uyuni/issues

Legal Notices

Copyright © 2018 – 2026 The Uyuni Project. Uyuni Project is part of openSUSE
Project

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
License. To view a copy of this license, visit http://creativecommons.org/
licenses/by-sa/3.0/es/ or send a letter to Creative Commons, PO Box 1866,
Mountain View, CA 94042, USA.

For SUSE trademarks, see http://www.suse.com/company/legal/. All other
third-party trademarks are the property of their respective owners. Trademark
symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks (*)
denote third-party trademarks.

All information found in this document has been compiled with utmost attention
to detail. However, this does not guarantee complete accuracy. Neither SUSE
LLC, its affiliates, the authors nor the translators shall be held liable for
possible errors or the consequences thereof.

Last updated 2026-10-19 11:06:55 +0200
