Release notes for Uyuni Server

Version 2026.06
2026-08-07 17:58:14 +0200
Table of Contents

  • Version Revision History
  • Stay informed
  • Support
  • Release model
  • Major changes since Uyuni Server 2025.05
      □ Features and changes
          ☆ Version 2026.08
              ○ Release notes cleanup
              ○ Monitoring
              ○ Ubuntu 26.04 Support
              ○ openSUSE Leap 15.6 and openSUSE Leap Micro 5.X End-of-Life
                Notice
              ○ Security Fixes
          ☆ Version 2026.06
              ○ Containers OS switched from openSUSE Leap 15.6 to openSUSE Leap
                16.0
              ○ Upcoming Podman 6.0.0 and Breaking Changes
              ○ Product Migration from SUSE Linux Enterprise Server 15 SP7 to
                16.0
              ○ Support for FIPS-Enabled Host OS
              ○ SUSE Liberty Linux 9.6 Support
              ○ Security Fixes
              ○ Debian 12 End-of-Life Notice
              ○ SUSE Registry URL Change: Update Your Allowlist
          ☆ Version 2026.04
              ○ Red Hat Enterprise Linux 10 Support
              ○ Online Database backup management with mgradm
              ○ Enhanced SCAP Auditing Integration (Technology Preview)
              ○ Product Migration from SUSE Linux Enterprise Server 15 SP7 to
                16.0
              ○ Reporting Dashboard for Grafana
              ○ Installation scripts merged with container images
              ○ New API Endpoint: listMigrationTargetsWithChannels
              ○ Monitoring: Grafana
              ○ Important Security Update
          ☆ Version 2026.03
              ○ CVE Auditing with OVAL (tech preview)
              ○ New products enabled
              ○ Upgrade to Tomcat 11 and Hibernate 7
              ○ Monitoring: Grafana
              ○ Security fixes
          ☆ Monitoring Server Components for SLES 12 Client Tools
          ☆ Version 2026.01
              ○ New products enabled
              ○ openSUSE Leap 16.0 Support
              ○ UI Support for Ansible Playbook Variables
              ○ Role-Based Access Control (RBAC) Configuration via Web UI
              ○ Monitoring: Prometheus upgraded to 2.53.4
              ○ Containerized BIND and DHCP Support
              ○ Security fixes
              ○ Database image updated to PostgreSQL 18
              ○ mgradm migrate deprecation
              ○ Ubuntu 20.04 End of Life
          ☆ Version 2025.10
              ○ Critical Vulnerabilities Addressed
              ○ Validated host OS switched from openSUSE Leap Micro 5.5 to
                openSUSE Tumbleweed
              ○ openSUSE Tumbleweed as client
              ○ Bulk Product Migration via System Set Manager
              ○ Generate and Upload Support Data from the UI
              ○ Container-Based KIWI Image Build Support
              ○ Removal of POS_Image-RPi-Bootstrap and
                pxe-yomi-image-opensuse15
              ○ Uyuni API version upgrade and breaking changes
          ☆ Version 2025.07
              ○ Important Salt Security Update
              ○ Important Security Updates
          ☆ Version 2025.05
              ○ Separate Database Container
              ○ Role-Based Access Control (RBAC) Implementation
              ○ Online Synchronization for Hub and Peripheral Servers
              ○ Ansible Integration Enhancements
              ○ Backup and Restore Support
              ○ SUSE Linux Micro 6.1 support as client
              ○ SUSE Linux Enterprise 15 SP7 family as clients
              ○ Add MAC based terminal naming option
              ○ POS image templates updates
              ○ RPMs including the container images in Uyuni
              ○ Health Check Tool
              ○ Improved CVE Audit with OVAL Data (Technology Preview)
              ○ Password Policy Enforcement for New Users
              ○ Product Migration Enhancement
              ○ Uyuni Documentation API changes
              ○ Monitoring
              ○ Removed features
              ○ Deprecated features
  • Known issues
      □ Availability of Salt’s "virt" module inside the Salt Bundle
      □ SSH SFTP Misconfiguration after SLES 16 Migration
      □ Uyuni 2025.10 fails to start because of ERROR: column "server_id" of
        relation "rhnactiondup" contains null values
      □ Hub XML-RPC Usage
      □ Onboarding Salt-SSH Managed Clients
      □ Reboot actions are not completed successfully
      □ Bootstrapping issue
      □ Issues with the Database Container
      □ salt-secrets-config.service fails to start after a migration
      □ Node Exporter port 9100 conflicts with Traefik
      □ Transactional systems - Salt SSH execution
      □ Onboarding issues in SUSE Linux Enterprise Micro and openSUSE Leap
        Micro 5.5
      □ Database restart
      □ AlmaLinux
      □ Bootstrap with web UI using non-root user
      □ CLM and custom repositories
      □ Container build host and Salt bundle
      □ Single Sign On, API and CLI tools
      □ EPEL and Salt packages
      □ Pay-as-you-go Connection requirement
      □ RHEL native clients
      □ Registering Spacewalk 2.x/Red Hat Satellite 5.x clients to Uyuni as
        Salt minions
      □ Ubuntu/Debian: duplicate entries in sources.list
  • Client Tools Notes
      □ Supported clients
  • Installation
      □ Requirements
      □ Installing the Server
      □ Update from previous versions of Uyuni Server
      □ Update from previous versions of Uyuni Proxy
  • Other information
      □ Red Hat Channels
      □ SUSE Channels
  • Providing feedback
  • Legal Notices

2026.08

Version Revision History

  • 2026/08/xx: 2026.08 release

  • 2026/07/09: 2026.06 release

  • 2026/04/29: 2026.04 release

  • 2026/03/10: 2026.03 release

  • 2026/02/05: 2026.01 release

  • 2025/11/04: 2025.10 release

  • 2025/08/01: 2025.07 release

  • 2025/06/02: 2025.05 release

  • Older versions from 2021.12 up to 2024.12

  • Older versions up to 4.0.0

Stay informed

The Uyuni community is always growing and evolving! To keep up with the latest
news, updates, and upcoming events, be sure to visit our main website at
www.uyuni-project.org. There, you will find our latest announcements and social
media feeds so you never miss a beat.

Support

Uyuni is proudly driven by its users and contributors. Whether you are looking
for troubleshooting help, want to share your own expertise, or just want to say
hello, our community is here for you!

You can find all the ways to connect with us on our dedicated get involved page
. This is your central hub for our chat rooms, mailing lists, and issue
trackers. Please do not hesitate to reach out.

Release model

To bring you the latest features and improvements as quickly as possible, Uyuni
follows a rolling release model. Instead of backporting bug fixes to older
versions, we frequently release entirely new versions packed with both the
latest features and necessary fixes. This keeps the project moving forward at a
rapid, exciting pace!

If you have ideas, feedback, or want to contribute to our next release, we
would love to hear from you. Check out our contact page to find the best way to
get involved.

Major changes since Uyuni Server 2025.05

Features and changes

Version 2026.08

Release notes cleanup

With Uyuni 2026.08, we are archiving the release notes of Uyuni versions older
than 2025.05 to make the document smaller and easier to navigate.

Release notes for older versions, from 2021.12 up to 2024.12, can still be
found at the website.

Monitoring

Grafana

Grafana has been updated from version 11.6.14+security04 to version 12.4.5 and
the new version provides several security fixes.

Breaking changes introduced in version 12.0.0:

   • Removed AngularJS and all deprecated UI Extensions APIs.

   • Enforced stricter version compatibility checks in plugin CLI install
     commands.

   • Enabled the failWrongDSUID feature flag by default, which rejects data
     sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5:

  • Added Legal-Review-Notice bsc#1271327.

  • Datasources: return 400 when payload UID does not match URL UID in PUT /api
    /datasources/uid/:uid.

  • Analytics: kept internal dashboard id.

  • Reporting: correctly apply appSubURL to report settings requests.

  • Alerting: documented Grafana HA Alertmanager cluster metrics prefix change.

  • Dependency updates to core plugins and UI libraries.

  • Updates to data source provisioning and dashboard schemas.

  • Introduced dynamic dashboards in public preview.

  • Added a new side toolbar that replaces the second top toolbar to provide
    additional vertical space.

  • Added the ability to create dashboards from templates using sample data.

  • Revamped the gauge visualization with rounded bars, configurable bar
    thickness, and endpoint markers.

  • Added support to map one variable to multiple values.

  • Released a completely redesigned logs visualization.

  • Added the ability to export dashboards directly as PNG images.

  • Introduced an interactive learning experience within the Grafana UI.

  • Added a Switch template variable type to quickly toggle between values in
    queries.

  • Added functionality to style table cells using CSS properties via the field
    cell option.

  • Added support for Entra Workload Identity to enhance authentication
    capabilities with federated credentials.

  • Redesigned the alert rule list page.

  • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.

  • Added support for Service Account Impersonation in the BigQuery data
    source.

  • Introduced the Grafana Advisor in public preview.

  • Introduced a new dashboard schema to replace the original single grid
    layout.

  • MIGRATION: Triggered a full-table rewrite for the annotation table, which
    may temporarily increase disk usage.

Check the upstream changelog for all the details.

Ubuntu 26.04 Support

Uyuni 2026.08 expands its list of supported operating systems with full
management support for Ubuntu 26.04 LTS clients. With this update,
administrators can manage Ubuntu 26.04 LTS systems directly from Uyuni 2026.08,
ensuring compliance, security, and consistency across all managed systems.

For detailed instructions on registering and managing Ubuntu clients, refer to
the client registration and supported features sections in the documentation.

openSUSE Leap 15.6 and openSUSE Leap Micro 5.X End-of-Life Notice

openSUSE Leap 15.6 reached end of life on April 30, 2026.

The Uyuni client tools supporting openSUSE Leap 15.X have been used also for
openSUSE Leap Micro 5.X and, in an upcomig Uyuni release the support for those
client tools will be removed.

 Administrators are strongly encouraged to migrate openSUSE Leap 15.6 clients
 to openSUSE Leap 16.0 so they can continue receiving security updates for the
 operating system.

Security Fixes

This update addresses important security vulnerabilities. We recommend
upgrading your Uyuni instances as soon as possible.

  • CVE-2026-33382 - bsc#1271331 - Grafana: Limited the size of request bodies
    processed by several Grafana API endpoints.

  • CVE-2025-12141 - bsc#1262187 - Grafana: Fixed an information leakage issue
    in Grafana Alerting.

  • CVE-2026-41607 - bsc#1263272 - Grafana: Fixed a potential information
    disclosure issue in Apache Thrift used by Grafana.

  • CVE-2026-8595 - bsc#1271557 - Grafana: Fixed Stored Cross-Site Scripting
    via malicious dashboard field name.

  • CVE-2026-42127 - bsc#1268868 - Grafana: Fixed Denial Of Service through
    memory exhaustion in grafana’s public dashboard query endpoint.

  • CVE-2026-9029 - bsc#1272328 - Grafana : Fixed arbitrary code execution and
    information disclosure via Cross-Site Scripting in geomap panel.

  • CVE-2026-39882 - bsc#1274217 - Grafana: Prevent memory exhaustion DoS in
    OpenTelemetry OTLP HTTP exporters by updating to v1.43.0.

  • CVE-2026-39882 - bsc#1274221 - Prometheus: Fixed unbounded HTTP response
    body reads by updating OpenTelemetry to version 1.43.0.

  • CVE-2026-33244 - bsc#1267416 - Prometheus: Fixed improper neutralization of
    the HTTP Location header value in React Router.

  • CVE-2026-13149 - bsc#1269917 - Prometheus: Prevented a potential
    denial-of-service by updating brace-expansion to version 5.0.7.

  • CVE-2026-33814 - bsc#1265827 - Prometheus: Fixed an infinite loop in the
    HTTP/2 transport implementation.

  • Prometheus: Improved the /-/config endpoint in Prometheus STACKIT SD to
    prevent secrets from being exposed in plaintext.

Version 2026.06

Containers OS switched from openSUSE Leap 15.6 to openSUSE Leap 16.0

With 2026.06, as openSUSE Leap 15.6 was out of support for already some time,
the base OS that is now used to build our containers is openSUSE Leap 16.0.

openSUSE Leap 16.0 uses Python 3.13 by default. This Python version (and
probably other SSL clients) validates certificates strictly and rejects any CA
certificate that does not mark the X509v3 Basic Constraints extension as
critical.

Please refer to the Migrate SSL Certificate Authorities for detailed
instructions to migrate the SSL Certificate Authorities.

In addition, the bump of the container base to Leap 16.0 will trigger a
PostgreSQL reindexing, and this could take a long time. This is due to the
glibc upgrade from Leap 15.6 (glibc 2.38) to Leap 16.0 (glibc 2.40).

Upcoming Podman 6.0.0 and Breaking Changes

openSUSE Tumbleweed will soon receive an update to Podman 6.0.0. Please be
aware that this major release introduces a significant number of breaking
changes. While the required database migration to SQLite is handled
automatically by Podman in the background, we strongly urge all administrators
to review the upstream documentation to understand how these changes might
impact their specific setups. Users running Uyuni Server or Proxies on other
operating systems should also prepare for these updates as Podman 6.0.0
eventually lands in their distribution’s repositories.

For a complete list of breaking changes and technical details, please read the
official Podman 6.0.0 Release Notes.

Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0

Uyuni 2026.06 now supports in-place product migration of managed clients from
SUSE Linux Enterprise Server 15 SP7 to SUSE Linux Enterprise Server 16.0.
Administrators can perform the migration directly from the Uyuni web interface
or through the API.

 Unlike standard product migrations, upgrading from SUSE Linux Enterprise
 Server 15 SP7 to 16.0 is a two-step process. The migration action runs first,
 followed by a mandatory verification step to confirm that the upgrade
 completed successfully before the system is considered fully migrated.

 This Migration path is currently only supported for regular minions. For
 minions managed by Salt SSH, migration is not yet supported.

For more information, see the SUSE Linux Enterprise Server 16 Upgrade Guide.

Support for FIPS-Enabled Host OS

Uyuni 2026.06 can now be deployed on a FIPS-enabled host OS.

This allows organizations with strict cryptographic compliance requirements to
run Uyuni within a FIPS-enforced environment.

SUSE Liberty Linux 9.6 Support

Uyuni 2026.06 adds bootstrap repository definitions and product entries for
SUSE Liberty Linux 9.6 EMS (Extended Minor Version Support).

Administrators can now register and manage SUSE Liberty Linux 9.6 clients
directly from Uyuni.

Security Fixes

This update addresses security vulnerabilities. We recommend upgrading your
Uyuni instances as soon as possible.

  • CVE-2026-34986 - bsc#1262950 - Fixed panic in JWE decryption.

  • CVE-2026-41602 - bsc#1263501 - Apache Thrift: Integer overflow or
    wraparound vulnerability.

  • CVE-2026-39821 - bsc#1266600 bsc#1266556 - Fixed validation bypass and
    privilege escalation by updating golang.org/x/net to version 0.55.0.

  • CVE-2026-42198 - bsc#1264174 - postgresql-jdbc: Client-side Denial of
    Service via malicious SCRAM-SHA-256 authentication.

  • CVE-2022-21698 - bsc#1248699 - prometheus: Replaced github.com/prometheus/
    client_golang with version 1.11.1.

  • CVE-2026-40179 - bsc#1262222 - Prometheus: Fixed stored XSS via unescaped
    label values in old UI heatmap chart tick labels.

  • CVE-2026-42151 - bsc#1263986 - Prometheus: Fixed AzureAD remote write OAuth
    client_secret exposure in plaintext via /-/config endpoint.

  • CVE-2026-42154 - bsc#1263987 - Prometheus: Fixed remote-read accepting
    snappy-compressed requests whose declared decoded length exceeds the decode
    limit.

  • CVE-2026-28374 - bsc#1265290 - Grafana: Fixed insecure direct object
    reference in Annotations API.

  • CVE-2026-28376 - bsc#1265289 - Grafana: Fixed unbounded memory allocation
    in Grafana Live push endpoint.

  • CVE-2026-28379 - bsc#1265288 - Grafana: Fixed viewer-triggered race
    condition in Grafana Live.

  • CVE-2026-28380 - bsc#1265287 - Grafana: Fixed broken access control in
    Snapshot API.

  • CVE-2026-28383 - bsc#1265286 - Grafana: Fixed unbounded memory allocation
    in plugin resources.

  • CVE-2026-33376 - bsc#1265285 - Grafana: Fixed Auth Proxy IPv6 allowlist
    bypass.

  • CVE-2026-33377 - bsc#1265284 - Grafana: Fixed dashboard editor privilege
    escalation.

  • CVE-2026-33378 - bsc#1265283 - Grafana: Fixed out-of-memory exception in
    Data Source Plugin.

  • CVE-2026-33380 - bsc#1265282 - Grafana: Fixed SQL Expressions vulnerability
    allowing authenticated attackers to read arbitrary files from the server
    filesystem.

  • CVE-2026-33381 - bsc#1265281 - Grafana: Fixed service account token
    generation after permission removal.

  • bsc#1269253 - spacewalk-java: formula.setFormulasOfGroup and
    formula.getCombinedFormulaDataByServerIds allow cross-organization broken
    access control.

  • bsc#1269534 - spacewalk-java: Authenticated Arbitrary File Write via Image
    Upload Filename Traversal.

Debian 12 End-of-Life Notice

Debian 12 (Bookworm) reaches end of life on June 30, 2026.

Uyuni will continue to support the management of Debian 12 clients for a
three-month grace period, until September 30, 2026.

 Administrators are strongly encouraged to migrate Debian 12 clients to Debian
 13 before end of life so they can continue receiving security updates from the
 Debian vendor.

SUSE Registry URL Change: Update Your Allowlist

The domain registry-store.suse.com was a temporary name used during the
migration of the SUSE registry infrastructure. The current and permanent domain
is registry-storage.suse.com.

 If your firewall or proxy allowlist includes registry-store.suse.com, update
 it to registry-storage.suse.com to ensure continued access to the SUSE
 registry. For the most up-to-date list of SUSE registry and SCC URLs required
 for firewall and proxy access, see the SUSE Customer Center and SUSE registry
 URLs.

Version 2026.04

Red Hat Enterprise Linux 10 Support

Uyuni introduces support for managing Red Hat Enterprise Linux 10 and its
compatible distributions, including SUSE Liberty Linux 10, AlmaLinux 10, Oracle
Linux 10 and Rocky Linux 10. This enables organizations running mixed
enterprise Linux environments to manage all their systems through a single,
unified platform using consistent tools and workflows.

 Red Hat Enterprise Linux 10 has raised the minimum supported x86-64
 microarchitecture baseline to x86-64-v3. Systems running on x86-64-v1 or
 x86-64-v2 CPUs cannot run RHEL 10 and will not be supported.

Online Database backup management with mgradm

Uyuni introduces online database backup management via mgradm, based on
postgresql continuous archiving (Write-Ahead Logging).

Administrators can manage the full backup lifecycle directly from the command
line, including creating base backups, monitoring backup status, rebasing,
restoring database content, and disabling backup management when needed.

Backups are stored in a dedicated Podman volume and are designed to reduce the
risk of data loss by continuously archiving database changes.

 Known issue: The storage volume needs to be created before the backup is
 enabled. Use the command: podman volume create var-pgsql-walbackup

 Only full recovery is supported. Point-in-time recovery currently requires a
 manual workflow.

For more information, refer to the Database Backup Management section in the
documentation.

Enhanced SCAP Auditing Integration (Technology Preview)

Uyuni introduces a modernized approach to SCAP (Security Content Automation
Protocol) auditing. The enhanced SCAP integration streamlines compliance
scanning by centralizing content management, introducing reusable policies,
supporting automated remediation, and eliminating the need to pre-stage SCAP
files on managed systems.

Key improvements include centralized SCAP content management, reusable scan
policies, automated remediation support, and recurring scan scheduling.

This feature is available as a Technology Preview and will be moved to a fully
supported state in a future release.

Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0

Uyuni supports migrating managed clients from SUSE Linux Enterprise Server 15
SP7 to SUSE Linux Enterprise Server 16.0 using the built-in product migration
feature. This enables administrators to seamlessly upgrade their managed
systems to the latest SUSE Linux Enterprise Server release directly from the
Uyuni web interface.

Reporting Dashboard for Grafana

Uyuni introduces a new reporting dashboard integrated with the existing Grafana
monitoring stack.

While the read-only reporting database continues to support third-party
visualization tools such as Metabase, this new dashboard provides a convenient
out-of-the-box option for viewing and filtering report data. Administrators can
leverage Grafana’s powerful visualization and filtering capabilities directly
within the existing monitoring infrastructure, eliminating the need to
configure additional tools.

Installation scripts merged with container images

Since the start of containerization, installation and configuration scripts
were part of our uyuni-tool’s mgradm utility. This release changes that and all
installation and upgrade scripts for both database and server are now part of
the images themselves. This concerns only scripts for actual server and
database. Other scripts and responsibilities, such as creating systemd entries,
self-signed certificates and major db upgrades, are still done by the mgradm
tool.

This change allows for Podman and Kubernetes versions to have identical
configurations and opens further possibilities in the future.

New API Endpoint: listMigrationTargetsWithChannels

The new listMigrationTargetsWithChannels endpoint returns, for each migration
target, the standard base channel label and childs channels.

This allows API consumers to select the correct target base channel for use
with scheduleProductMigration in a single call.

Monitoring: Grafana

Grafana has been updated from version 11.6.11 to version 11.6.14+security-01

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v11.6.12

  • Grafana Release v11.6.13

  • Grafana Release v11.6.14

  • Grafana Release v11.6.14+security-01

Important Security Update

This update addresses several high-severity CVEs. We highly recommend upgrading
your Uyuni instances as soon as possible to ensure they remain secure. The
following CVEs are included in this release:

  • CVE-2026-26958 - bsc#1258595 - edwards25519: Bump filippo.io/edwards25519
    to version 1.1.1 to address security vulnerabilities.

  • CVE-2026-21725 - bsc#1258873 - grafana: Fix missing UID when deleting
    datasource by name.

  • CVE-2026-33375 - bsc#1260881 - grafana: Fix denial of Service via
    out-of-memory exhaustion in MSSQL data source plugin.

  • CVE-2026-27876 - bsc#1261025 - grafana: Fix remote arbitrary code execution
    via chained SQL Expressions.

  • CVE-2026-27877 - bsc#1261026 - grafana: Fix information disclosure of
    data-source passwords via public dashboards.

  • CVE-2026-28375 - bsc#1261029 - grafana: Fix denial of service via testdata
    data-source.

  • CVE-2026-27879 - bsc#1261027 - grafana: Fix denial of service via resample
    query.

  • CVE-2026-33186 - bsc#1260263 - grafana: Fix authorization bypass due to
    improper validation of the HTTP/2 :path pseudo-header.

  • CVE-2026-21724 - bsc#1260878 - grafana: Fix authorization bypass allows
    modification of protected webhook URLs.

  • CVE-2025-29923 - bsc#1259999 - grafana: Fix potential out of order
    responses when CLIENT SETINFO times out during connection establishment.

  • CVE-2022-21698 - bsc#1248707 -
    golang-github-QubitProducts-exporter_exporter: Denial of service using
    InstrumentHandlerCounter.

  • CVE-2022-21698 - bsc#1248699 - prometheus-postgres_exporter: Denial of
    service using InstrumentHandlerCounter.

  • CVE-2026-27459 - bsc#1259808 - venv-salt-minion(pyopenssl): large cookie
    value can lead to a buffer overflow

  • CVE-2026-27448 - bsc#1259804 - venv-salt-minion(pyopenssl): unhandled
    exception can result in connection not being cancelled

Version 2026.03

CVE Auditing with OVAL (tech preview)

Updated schema to improve performance. Changes made will remove existing OVAL
data upon migration. OVAL data will be resynced within the next 24h. If
immediate use of the feature is desired a manual oval-data-sync should be
performed.

New products enabled

  • Debian 13

Upgrade to Tomcat 11 and Hibernate 7

This release update Tomcat to version 11 and Hibernate to version 7. Together
with this a lot of Java packages were updated as well. This renewal of the
codebase was required due to EOL of the currently used versions.

Monitoring: Grafana

Grafana has been updated from version 11.5.10 to version 11.6.11

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v11.6.0

  • Grafana Release v11.6.1

  • Grafana Release v11.6.2

  • Grafana Release v11.6.3

  • Grafana Release v11.6.4

  • Grafana Release v11.6.5

  • Grafana Release v11.6.6

  • Grafana Release v11.6.7

  • Grafana Release v11.6.8

  • Grafana Release v11.6.9

  • Grafana Release v11.6.10

  • Grafana Release v11.6.11

Security fixes

  • CVE-2025-13465 prometheus: Bump lodash package to version 4.17.23 to fix
    prototype pollution vulnerability bsc#1257329

  • CVE-2025-61140 prometheus: jsonpath: the value function is vulnerable to
    prototype pollution bsc#1257442

  • CVE-2026-1615 prometheus: jsonpath: arbitrary code injection due to unsafe
    evaluation of user-supplied JSON Path expressions bsc#1257897

  • CVE-2026-25547 prometheus: Fix unbounded brace range expansion leading to
    excessive CPU and memory consumption bsc#1257841

  • CVE-2026-21720 grafana: Fix unauthenticated DoS bsc#1257349

  • CVE-2026-21721 grafana: Fix access control by the dashboard permissions API
    bsc#1257337

  • CVE-2025-3415 grafana: exposure of DingDing alerting integration URL to
    Viewer level users bsc#1245302

  • CVE-2026-21722 grafana: Public dashboards annotations: use dashboard
    timerange if time selection disabled bsc#1258136

  • CVE-2024-29371 jose4j: Safeguard against excessive resource utilization by
    restricting the size of data during JWE payload decompression (bsc#1255298)

  • CVE-2026-27727 mchange-commons: Possible download and execution of
    malicious code triggered by reading a maliciously crafted
    javax.naming.Reference or serialized object. (bsc#1258913)

  • CVE-2026-27830 c3p0: Deserialization vulnerability through maliciously
    crafted Java serialized objects and javax.naming.Reference instances (bsc#
    1258942)

Monitoring Server Components for SLES 12 Client Tools

Starting with Uyuni 2026.03, the monitoring server related packages included in
the SLES 12 client tools channels have been removed and will no longer receive
updates. These packages previously enabled a SLES 12 system to act as a
monitoring server and included components such as Prometheus, Alertmanager,
Grafana, and related dashboards.

Client side monitoring components (exporters) will continue to be provided,
allowing SLES 12 systems to remain monitored by an external monitoring server.

Version 2026.01

New products enabled

  • SUSE Linux Enterprise Server 15 SP6 LTSS

  • SUSE Linux Enterprise Server 16

  • SL Micro 6.2

openSUSE Leap 16.0 Support

Uyuni also introduces support for managing openSUSE Leap 16.0 systems. This
enables administrators and developers to manage community-driven environments
using the same tools and workflows as enterprise platforms, making openSUSE
Leap 16.0 well suited for development, testing, and mixed environments.

For detailed instructions on registering and managing these clients, refer to
the Registration section in the documentation.

UI Support for Ansible Playbook Variables

Uyuni introduces the ability to edit Ansible playbook variables directly in the
Web UI. This feature allows a single playbook to be executed dynamically across
multiple systems by customizing variable values at runtime, eliminating the
need to modify the source playbook.

The Web UI now generates input fields based on the variables defined in a
playbook. When selecting a playbook under System > Ansible > Playbooks,
administrators can provide system-specific values immediately before execution,
making it easier to reuse playbooks for different configurations.

Role-Based Access Control (RBAC) Configuration via Web UI

Administrators can now manage Role-Based Access Control (RBAC) directly through
the Web UI. Previously, these tasks required direct API interaction.

This enhancement simplifies the management of User Access Groups and policies,
providing an intuitive interface to utilize the fine-grained access control
features introduced in Uyuni 2026.01.

Monitoring: Prometheus upgraded to 2.53.4

Prometheus golang-github-prometheus-prometheus has been upgraded from version
version 2.53.4 to next LTS version 3.5.0. The update includes number of
enhancements and bug fixes.

Check the upstream changelogs for more details:

  • https://github.com/prometheus/prometheus/releases/tag/v3.5.0

Containerized BIND and DHCP Support

Uyuni introduces support for containerized deployments of BIND and DHCP
services on branch servers.

  • The BIND formula configures the Domain Name System (DNS) service.

  • The DHCP formula configures the DHCP (Kea) service.

By default, these formulas pull container images from registry.suse.com.

Security fixes

Authentication protocol downgrade fix

A vulnerability (CVE-2025-62349) that allowed Salt minions to bypass security
checks by downgrading the authentication protocol has been fixed. A new
configuration option, minimum_auth_version, has been introduced to enforce the
minimum supported authentication protocol version. The default is 3 in salt
3006.x.

This prevents downgrade attacks and ensures that only minions using secure
authentication protocols can connect.

 The new default (minimum_auth_version: 3) blocks older minions that use
 protocol versions lower than 3. Such minions will fail to connect with errors
 similar to:

 Rejected authentication attempt using protocol version 1 (minimum required: 3)`

 If your deployment contains older minions, you must temporarily set the
 following in the master configuration before upgrading the master, then restart
 the master service

 minimum_auth_version: 0

 After the upgrade, when feasible and once you are able to upgrade all minions
 to the latest version provided by Uyuni, remove the temporary override from the
 master configuration.

Besides this CVE-2025-62349, this update also fixes CVE-2025-62348 and few
other security related issues around tornado.

Other security fixes

This update comes with number of security fixes

  • CVE-2025-67724 python-tornado: Missing validation of supplied reason phrase
    bsc#1254903

  • CVE-2025-67725 python-tornado: Fix DoS via malicious HTTP request bsc#
    1254905

  • CVE-2025-67726 python-tornado: Fix HTTP header parameter parsing algorithm
    bsc#1254904

  • CVE-2025-68156 grafana: Fix potential DoS via unbounded recursion in
    builtin functions bsc#1255340

  • CVE-2025-12816 prometheus Interpretation conflict vulnerability allowing
    bypassing cryptographic verifications bsc#1255588

Database image updated to PostgreSQL 18

With this Uyuni release we update the database container to support PostgreSQL
18. This also means that an upgrade will trigger a database migration.

 This change requires Uyuni version 2025.05 as the minimal Uyuni version to
 upgrade from.

mgradm migrate deprecation

Starting with Uyuni 2026.01, mgradm migrate subcommand has been deprecated. The
migrate command is not needed for Uyuni as it uses a rolling release model.

Ubuntu 20.04 End of Life

Ubuntu 20.04 was End of Life on May 31st, 2025.

After a grace period of more than 3 months, Uyuni will stop support for this
operating system after Uyuni 2026.01.

While existing client tools repositories will not be removed, they will not get
updates.

As for the code, it will not be broken on purpose, but it will not get tested
for Ubuntu 20.04 anymore.

All remaining users with Ubuntu 20.04 systems are encouraged to migrate to
Ubuntu 22.04 or Ubuntu 24.04 as soon as possible.

Version 2025.10

Critical Vulnerabilities Addressed

This release addresses a few high-severity CVEs. These vulnerabilities could
pose significant security risks if not addressed.

  • CVE-2025-53883: spacewalk-java: various XSS found on search page (bsc#
    1246439)

  • CVE-2025-53880: susemanager-tftpsync-recv: arbitrary file creation and
    deletion due to path traversal (bsc#1246277)

Considering that the affected one was only legacy code not used anymore in
Uyuni, from the server-image it was decided to remove susemanager-tftpsync, and
from the proxy-httpd-image the removed package was susemanager-tftpsync-recv.

In addition, another security issue worth mentioning:

  • spacecmd, susemanager, rhnlib and spacewalk-backend: usage of unsafe third
    party library for XML (bsc#1227577)

Validated host OS switched from openSUSE Leap Micro 5.5 to openSUSE Tumbleweed

With 2025.10, as previously decided by the community, and as openSUSE Leap
Micro 5.5 was out of support for already some time, the base OS that is now
validated is openSUSE Tumbleweed. Of course, this does not mean that any
Community member is forced to run Uyuni on this OS, rather only that this is
the version that was internally tested. We would be glad to hear feedback from
the Community using a different host OS, and will try our best to fix any issue
showing up on any other version.

To perform the migration from openSUSE Leap Micro 5.5, please check the Migrate
Uyuni Server from openSUSE Leap Micro 5.5 to Tumbleweed section of the
documentation.

openSUSE Tumbleweed as client

Uyuni 2025.10 now supports managing openSUSE Tumbleweed as client.

For details on the registration process, please refer to the Registration
section. To learn more about supported features, consult the Supported Features
section in our documentation.

Bulk Product Migration via System Set Manager

It is now possible to schedule product migrations directly from the web UI for
multiple servers at once using the System Set Manager. This streamlines
large-scale migrations by allowing administrators to plan and execute them in a
single step.

Generate and Upload Support Data from the UI

This new feature allows administrators to generate a support data archive for a
system directly from the web UI and upload it to SUSE Customer Center. This
simplifies the process of providing support information for troubleshooting.

Container-Based KIWI Image Build Support

Uyuni 2025.10 introduces a container-based KIWI image build system, in addition
to the existing legacy KIWI and KIWI NG tools.

The build system used depends on the underlying OS or specific pillar values:

  • SLE 11 / SLE 12 → legacy KIWI v7

  • SLE 15 → KiwiNG (v9 and containerized KIWI 10)

Administrators can override the default behavior using the following pillar or
custom values:

  • use_kiwi_ng → force the use of KIWI 9

  • use_kiwi_container → force the use of containerized KIWI 10

This release also allows all SUSE family OSes to become build hosts, that means
openSUSE Leap and openSUSE Tumbleweed as well. Those will automatically use
containerized KIWI.

Removal of POS_Image-RPi-Bootstrap and pxe-yomi-image-opensuse15

The images POS_Image-RPi-Bootstrap and pxe-yomi-image-opensuse15 were not
really in use, and as they were having build failures and no reports had ever
been received about them, it was simply decided to drop them.

Uyuni API version upgrade and breaking changes

Due to the changes introduced in this version, the Uyuni Documentation API has
been upgraded from version 28 to 29.

For the XMLRPC API, some standard exceptions are now FaultException, and some
were renamed:

  • ContentSyncException ⇒ ContentSyncException as FaultException

  • BadParameterException ⇒ InvalidParameterException

  • FileNotFoundException ⇒ IOFaultException

  • DuplicateProfileNameException ⇒ DuplicateProfileNameException as
    FaultException

  • LookupException ⇒ PermissionCheckFailureException

  • PermissionException ⇒ PermissionCheckFailureException

  • IllegalArgumentException ⇒ InvalidParameterException

  • IllegalStateException ⇒ InvalidArgsException

These can be considered breaking changes as when some of these exceptions are
expected to be caught, different ones are now received instead, and the
handling will not work anymore.

For Rest-like-API it might not be considered a breaking change, as there are no
exceptions but error codes.

For further details about the API, please refer to the Uyuni API Documentation.

Version 2025.07

Important Salt Security Update

This update includes some critical fixes for Salt. The following CVE fixes are
part of this release:

  • CVE-2024-38824 - bsc#1244565

  • CVE-2025-22239 - bsc#1244574

  • CVE-2025-22236 - bsc#1244568

  • CVE-2025-22237 - bsc#1244571

  • CVE-2024-38825 - bsc#1244566

  • CVE-2025-22240 - bsc#1244567

  • CVE-2024-38823 - bsc#1244564

  • CVE-2025-22241 - bsc#1244570

  • CVE-2025-22238 - bsc#1244572

  • CVE-2025-22242 - bsc#1244575

  • CVE-2024-38822 - bsc#1244561

 These CVEs affect both the Salt master and the minions. Some of these
 vulnerabilities are very critical and could pose significant security risks if
 not addressed. User must upgrade both the Salt master and the minions to
 ensure their environment is protected.

 As always, the Salt master must be upgraded before upgrading the minions. This
 is especially important in this case to prevent exceptions or errors on the
 minions if the master has not been updated first.

Important Security Updates

This update includes some critical fixes for Uyuni Server. The following CVE
fixes are part of this release:

  • CVE-2025-46811 - bsc#1246119

  • CVE-2025-46809 - bsc#1245005

Version 2025.05

Separate Database Container

Uyuni 2025.05 now includes the PostgreSQL database in a separate container. As
this new database container no longer shares the SSL certificate with the web
server, the password of the SSL CA key is required when upgrading from any
older version. When using third party certificates, a certificate and key for
the database will need to be provided instead.

To help with backing up and restoring the data a new tool mgradm backup command
is available, more information about it can be found in the Backup and restore
section of the documentation.

Please check the list of containers for further reference.

Role-Based Access Control (RBAC) Implementation

Uyuni 2025.05 now supports Role-Based Access Control (RBAC) to provide users
with fine-grained access control and configuration options. This enhancement
centralizes access control rules, making them easier to manage and adapt. The
implementation is designed to be flexible, allowing new use cases and rules to
be defined through configuration rather than code changes. The Uyuni Server
will include sensible default policies while also enabling users to create
custom access policies (user access groups) to suit their specific
requirements.

The Uyuni Server has this feature enabled by default, and includes sensible
default policies while also enabling users to create custom access policies
(user access groups) to suit their specific requirements.

Online Synchronization for Hub and Peripheral Servers

Uyuni 2025.05 introduces a new online synchronization mechanism between the Hub
and peripheral servers, providing a more user-friendly and automated approach
to content synchronization. This enhancement leverages existing stable
mechanisms to deliver a robust and efficient solution and significantly
improves both performance and the overall user experience. With the Hub
architecture, centralized content management is now seamlessly extended to
peripheral servers.

The new 'Hub online synchronization' feature builds on the existing repository
synchronization mechanism. It allows peripheral servers to sync their software
channels directly from repositories hosted on the Hub server. Once the
connection is established, the Hub becomes the primary content source for its
connected peripheral servers.

Currently, this functionality is limited to software channels, but future
releases will expand support to include other artifacts such as images and
configuration channels.

As part of this improvement, the already deprecated ISSv1 will be removed.
ISSv2 will remain available for offline synchronization scenarios.

Ansible Integration Enhancements

Uyuni 2025.05 includes a range of enhancements to its Ansible integration,
making it easier to manage automation workflows directly from within the
product. These improvements aim to streamline day-to-day operations and
increase visibility and control over Ansible-driven configurations.

Key improvements include:

  • Display of raw Ansible playbook output in the event history of the control
    node, along with a list of all targeted systems.

  • Support for recurrent (scheduled) execution of Ansible playbooks.

  • Ability to configure default playbook and inventory paths when adding a new
    control node

  • New filter option in the system list to easily identify Ansible-managed
    systems onboarded

These enhancements mark a major step forward in improving Ansible usability and
integration in Uyuni.

Backup and Restore Support

Uyuni 2025.05 introduces a built-in backup and restore solution via the mgradm
backup command-line tool. It provides a reliable and consistent way to
safeguard your Uyuni installation, simplifying disaster recovery and system
migration.

The mgradm backup create command performs a full backup of all critical data,
while mgradm backup restore enables system recovery. Additional subcommands and
options are available and can be viewed using the tool’s help output.

Regular use of this tool is recommended to prevent data loss and ensure quick
recovery in case of failure.

 This approach may require substantial disk space and time to complete,
 depending on the size of your environment.

SUSE Linux Micro 6.1 support as client

Uyuni 2025.05 now supports managing SUSE Linux Micro 6.1 as client.

For more information about the registration process, refer to the Registration
section, and for more information about supported features, consult the
Supported Features.

SUSE Linux Enterprise 15 SP7 family as clients

Uyuni 2025.05 now supports managing SUSE Linux Enterprise 15 SP7 family as
clients.

For details on the registration process, please refer to the Registration
section. To learn more about supported features, consult the Supported Features
section in our documentation.

Add MAC based terminal naming option

Uyuni now allows users to configure Minion registration to use a MAC address
instead of HW-TYPE-MACHINE-ID during the setup of Uyuni for Retail.

By using the MAC address in the registration string, each machine becomes
uniquely identifiable, reducing confusion in scenarios such as network or boot
issues, where multiple entries for the same hardware might have previously
occurred.

This enhancement improves clarity and simplifies hardware identification and
management within Uyuni for Retail environments.

POS image templates updates

Following updates have been made in the POS image templates

  • JeOS7 and Graphical7 templates can now be built also on SUSE Linux
    Enterprise 15 SP6 build host

  • JeOS7 and Graphical7 templates no longer silently ignore saltboot dracut
    module installation failure

RPMs including the container images in Uyuni

As an effort to support air-gapped environments, Uyuni now includes RPMs with
the different images, for both Server and Proxy.

For further reference, please check the documentation in the section Air-gapped
Deployment

Health Check Tool

Uyuni 2025.05 comes with a standalone Health Check tool. This tool provides a
detailed dashboard, metrics, and logs from the server, showcasing its current
health status based on the support-config. Users can efficiently evaluate the
health of their running instance and identify any potential errors for
effective troubleshooting.

Improved CVE Audit with OVAL Data (Technology Preview)

The CVE Audit feature in Uyuni has traditionally relied on patch metadata from
channels to identify affected systems.

With this release, Uyuni introduces a new and improved CVE Audit mechanism
based on OVAL (Open Vulnerability and Assessment Language) data. This new
approach allows for more precise and accurate vulnerability assessments by
evaluating system packages directly against OVAL definitions.

This feature is currently released as a Technology Preview. Users can begin
testing the OVAL-based CVE Audit to gain better insights into their systems'
exposure to known vulnerabilities.

 This enhancement is disabled by default. Users can manually enable it to try
 the new functionality. If any issues arise, the system can easily revert to
 the previous patch-based CVE Audit by changing the relevant configuration
 setting.

For more information, see Oval section.

Password Policy Enforcement for New Users

In previous versions, Uyuni did not support password policy enforcement.
Administrators could set any password for users, regardless of complexity.

With this release, administrators can now define and enforce password policies
for Uyuni users. Once configured, the system ensures that all newly created
user passwords adhere to the specified rules.

This helps organizations comply with internal security standards and improve
overall password security.

 Existing user accounts are not affected retroactively. This enforcement
 applies only to newly created user accounts. Users are encouraged to review
 and adjust their password policy settings under the Admin section to match
 their organization’s security needs.

Product Migration Enhancement

The product migration feature has been enhanced, allowing users to seamlessly
migrate their SUSE Linux Enterprise Server systems to SUSE Linux Enterprise
Server for SAP when needed. This improvement significantly enhances the user
experience, eliminating the need for specific scripts previously required, as
it is now integrated into Uyuni’s capabilities.

Uyuni Documentation API changes

Due to the changes introduced in this version, the Uyuni Documentation API has
been upgraded from version 27 to 28.

This version removes the deprecated method synchronizeChannels from
sync.content

For further details about the API, please refer to the Uyuni API Documentation.

Monitoring

Grafana

Grafana has been updated from version 10.4.13 to version 11.5.5, including
breaking changes. The following CVEs have been addressed:

  • CVE-2025-22872

  • CVE-2025-3580

  • CVE-2025-3454

  • CVE-2025-2703

  • CVE-2025-22870

  • CVE-2024-9476

  • CVE-2024-9264

  • CVE-2023-45288

  • CVE-2025-4123

  • CVE-2025-27144

  • CVE-2024-51744

  • CVE-2024-45339

  • CVE-2024-11741

  • CVE-2024-45337

Check the upstream changelog for all the details.

For detailed information about the fixes and features, you can refer to the
following links:

  • Grafana Release v10.4.14

  • Grafana Release v10.4.15

  • Grafana Release v11.0.0

  • Grafana Release v11.0.1

  • Grafana Release v11.1.0

  • Grafana Release v11.1.1

  • Grafana Release v11.1.3

  • Grafana Release v11.1.4

  • Grafana Release v11.1.5

  • Grafana Release v11.2.0

  • Grafana Release v11.2.1

  • Grafana Release v11.2.2

  • Grafana Release v11.3.0

  • Grafana Release v11.3.1

  • Grafana Release v11.4.0

  • Grafana Release v11.4.1

  • Grafana Release v11.5.0

  • Grafana Release v11.5.1

  • Grafana Release v11.5.2

  • Grafana Release v11.5.3

  • Grafana Release v11.5.4

  • Grafana Release v11.5.5

Node exporter upgraded to 1.9.1

With Uyuni 2025.05, golang-github-prometheus-node_exporter has been updated
from version 1.7.0 to version 1.9.1, with no breaking changes.

Check the upstream changelogs for more details (including some release upgrades
not previously mentioned in the release notes):

  • https://github.com/prometheus/node_exporter/releases/tag/v1.9.1

  • https://github.com/prometheus/node_exporter/releases/tag/v1.9.0

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.2

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.1

  • https://github.com/prometheus/node_exporter/releases/tag/v1.8.0

The following CVEs have been addressed:

  • CVE-2025-22870: Matching of hosts against proxy patterns can improperly
    treat an IPv6 zone ID as a hostname component

  • CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary
    amounts of header data by sending an excessive number of CONTINUATION
    frames

Prometheus upgraded to 2.53.4

Prometheus golang-github-prometheus-prometheus has been upgraded from version
2.45.6 to version 2.53.4. The update includes number of enhancements and bug
fixes.

This upgrade also includes the fix for the following CVEs:

  • CVE-2023-45288

  • CVE-2025-22870

  • CVE-2024-51744

Check the upstream changelogs for more details:

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.4

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.3

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.53.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.52.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.51.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.50.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.50.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.49.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.49.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.48.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.48.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.2

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.1

  • https://github.com/prometheus/prometheus/releases/tag/v2.47.0

  • https://github.com/prometheus/prometheus/releases/tag/v2.46.0

Prometheus Alertmanager

Prometheus golang-github-prometheus-alertmanager has been patched to include
the fix for the following CVEs:

  • CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http

  • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs

Blackbox exporter

Prometheus prometheus-blackbox_exporter has been updated from version 0.24.0 to
version 0.26.0.

Check the upstream changelogs for more details:

  • https://github.com/prometheus/blackbox_exporter/releases/tag/v0.26.0

  • https://github.com/prometheus/blackbox_exporter/releases/tag/v0.25.0

The fixes for the following CVEs have been included:

  • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs

  • CVE-2023-45288: Fix closing connections when receiving too many

Removed features

Virtualization

The virtualization feature, deprecated in Uyuni 2024.07, has been fully removed
in version 2025.05. If you still rely on VM management functionalities, we
highly recommend considering alternatives like https://harvesterhci.io/.

ISSv1

Starting with the Uyuni 2025.05 release, ISSv1 has been fully removed,
following its deprecation in previous releases. For offline inter-server
synchronization, ISSv2 is now available. For online synchronization, the
required functionality is fully integrated into the Hub server. If you
encounter any gaps or issues during this transition, please don’t hesitate to
contact us for assistance.

Deprecated features

Changes to Debian and Ubuntu Monitoring Exporters

Monitoring exporters are no longer included with the Debian and Ubuntu Uyuni
Client Tools. Going forward, please install the required exporters directly
from your distribution’s standard repositories (such as the 'main' or
'universe' channels).

Prometheus exporters for RHEL and Clones

Effective with Uyuni 2026.06, all Prometheus exporters provided in the RHEL and
clone client tools, with the exception of the Node Exporter
(golang-github-prometheus-node_exporter) are deprecated and scheduled for
removal in a future release.

Users who require these exporters on client systems should obtain them directly
from their respective upstream vendors.

smdba tool

Starting with Uyuni 2025.05, the smdba tool has been deprecated. Alternative
solutions for backup, restore, and database tuning will be provided, with the
new tool mgradm backup being available now.

'spacewalk-manage-channel-lifecycle' has been deprecated

In previous releases, the spacewalk-clone-by-date tool was deprecated in favor
of Content Lifecycle Management (CLM), a more powerful and flexible solution.

We are now also deprecating spacewalk-manage-channel-lifecycle, as CLM fully
covers the functionality of both tools.

CLM’s comprehensive API provides all key capabilities previously offered, and
we strongly recommend migrating existing workflows and scripts to CLM.

Known issues

Availability of Salt’s "virt" module inside the Salt Bundle

For openSUSE Leap, Tumbleweed and SLE family, the Salt Bundle provides the
necessary Python libvirt libraries for the Salt’s virt module to work, but it
requires the libvirt-libs package to be installed. This package must be
installed manually by the user in the managed client where we want to interact
with the virt module of Salt. Otherwise you would get an issue when interacting
with the module:

# venv-salt-call virt.all_capabilities
[...]
'virt' __virtual__ returned False: Unable to locate or import python libvirt library.

SSH SFTP Misconfiguration after SLES 16 Migration

Migrating systems from SUSE Linux Enterprise Server 15 SP7 to SUSE Linux
Enterprise Server 16 or from openSUSE Leap 15.6 to openSUSE Leap 16.0 can leave
an outdated SFTP subsystem path in /etc/ssh/sshd_config. This causes file
transfer protocols like scp and sftp to fail. A permanent automated fix will be
included in the next update.

Until the next update is released, please apply the following manual fix on
affected SLES 16 minions:

 1. Open /etc/ssh/sshd_config and locate the Subsystem sftp line.

 2. Change the path from /usr/lib/ssh/ to /usr/libexec/ssh/:

    - Subsystem      sftp    /usr/lib/ssh/sftp-server
    + Subsystem      sftp    /usr/libexec/ssh/sftp-server

 3. Restart the SSH daemon to apply the changes:

    systemctl restart sshd

Uyuni 2025.10 fails to start because of ERROR: column "server_id" of relation
"rhnactiondup" contains null values

This issue was first reported for the Enterprise product, SUSE Multi-Linux
Manager, in its version 5.1.1. The fix is however the same and it was explained
in this TID:

https://support.scc.suse.com/s/kb/
SUSE-Multi-Linux-Manager-5-1-1-fail-to-start-because-of-ERROR-column-server-id-of-relation-rhnactiondup-contains-null-values?
language=en_US

Hub XML-RPC Usage

To use the Hub XML-RPC API, users must manually assign the Peripheral Server
entitlement to peripheral servers. A fix is in progress, but for now this
manual step is required in order to use the Hub XML-RPC API.

Onboarding Salt-SSH Managed Clients

Onboarding Salt-SSH managed clients currently only works when performed by an
Uyuni administrator. This limitation will be addressed in the next milestone.

Reboot actions are not completed successfully

Scheduled reboot events are currently being detected, but their completion
status is not reported back. This issue is known and will be addressed in the
next milestone.

Bootstrapping issue

Bootstrap may occasionally fail with a "Minion is down" error. We are
investigating the issue, and a fix is expected in the next milestone.

Issues with the Database Container

Some issues remain unresolved in context of database container

  • Hostname renaming is not yet supported.

  • SSL certificate and CA rotation functionality is incomplete.

  • Disk space checks are currently non-functional

salt-secrets-config.service fails to start after a migration

This was reported with the release of Uyuni 2024.07, and will likely also
happen with 2024.08, the last RPM based version. Users should run the command:

zypper install spacewalk-backend-server

From within the options given, select the one to drop
spacewalk-backend-config-files-common, spacewalk-backend-config-files and
spacewalk-backend-config-files-tool

Node Exporter port 9100 conflicts with Traefik

Uyuni container uses port 9100 for Node Exporter. The same port is used by
Traefik default configuration to exports its own metrics, so there is a
conflict and Traefik fails to start:

2024/07/13 09:02:29 traefik.go:80: command traefik error: error while building entryPoint node-exporter: error preparing server: error opening listener: listen tcp :9100: bind: address already in use

The failure can be hidden because Kubernetes keeps running the Traefik with the
old configuration.

A fix to this issue will be available in the next Uyuni release.

Transactional systems - Salt SSH execution

The Salt SSH execution utilized during the onboarding process may face
inconsistencies if a Salt Minion or the Salt Bundle is already present on the
Minion, which could potentially result in onboarding failure.

Workaround: If the salt-minion or venv-salt-minion packages are already
installed, remove them, and then proceed to onboard the SUSE Linux Enterprise
Micro or openSUSE Leap Micro system.

Onboarding issues in SUSE Linux Enterprise Micro and openSUSE Leap Micro 5.5

There is a very specific case in which onboarding of the mentioned systems will
not work. This only happens when the package venv-salt-minion was already
installed on the target system. The issue is being investigated in order to
provide a fix. For the time being, our recommendation is to remove the affected
package first, and let the onboarding process reinstall it.

Database restart

If the Uyuni services are already running, they may not handle a PostgreSQL
database restart seamlessly. Restarting these services is necessary in such
cases. We are actively working on enhancing the resilience of these services to
recover gracefully in the event of a database restart.

If you encounter issues with Uyuni after a PostgreSQL restart, we recommend
restarting the Uyuni services using the command spacewalk-service restart.

AlmaLinux

Because of an upstream bug, the original package shipped with AlmaLinux 8.5 is
providing a broken repository file (containing duplicated identificators). We
have already reported this issue to AlmaLinux.

Workaround: Update the package almalinux-release before registering the
instance to Uyuni so at least the version 8.5-3 is installed.

Bootstrap with web UI using non-root user

Onboarding of clients with the non-root user from the Uyuni UI fails the
following error:

ERROR com.suse.manager.webui.controllers.utils.AbstractMinionBootstrapper - Error during bootstrap: SaltSSHError(13, stderr: "", stdout: "ERROR: Failure deploying ext_mods:"

The root cause of this problem is a wrong ownership of the Salt thin directory
when using the Salt bundle.

Workaround: Once bootstrap fails, the user can run chown -R $USER:$GROUP /var/
tmp/.*_salt once and try onboarding again, it shouldn’t fail this time.

CLM and custom repositories

When building a CLM project that includes custom channels with custom
repositories, the custom repositories might not be selected in the new cloned
custom channels. As a workaround, one can go to the new cloned custom channels,
select the custom repositories and synchronize them.

Container build host and Salt bundle

The container build host will not work with the Salt bundle. We are working on
a fix. Meanwhile, don’t use the Salt bundle on the Container build host but
rather a normal Salt.

Single Sign On, API and CLI tools

Single Sign On can be used to authenticate in the Web UI but not with the API
or CLI tools. This will be fixed in a future release of Uyuni.

EPEL and Salt packages

Using the Extra Packages for Enterprise Linux directly on RHEL clients (or
compatible: CentOS, Oracle Linux, etc) will install the Salt packages from
EPEL, which miss some features in the Uyuni-provided Salt packages. This is an
unsupported scenario.

If you need to enable the EPEL repository, make sure you are using the Salt
Bundle (it is used by default with new clients but not for clients onboarded
before Uyuni 2022.04)

Pay-as-you-go Connection requirement

For a fully operational PAYG Connection for SUSE Linux Enterprise Server or
SUSE Linux Enterprise Server for SAP Applications clients, it’s crucial to have
the instance-flavor-check tool installed, which is bundled within the
python-instance-billing-flavor-check package. While this package is
automatically installed on all newly created instances, for older running
instances, manual installation is necessary to prevent potential errors. If
you’re working with older Cloud instances, you can install this package
manually from the Public Cloud Module. For SUSE Linux Enterprise Micro 5.3 and
5.4, the instance-flavor-check is directly available and there’s no need to
enable extra modules.

RHEL native clients

When autogenerating bootstrap repositories for native RHEL clients, some errors
may be logged from the moment the official Red Hat channels are added until the
moment those channels are fully synchronized for the first time.

This does not affect CentOS, Rocky Linux, AlmaLinux or Oracle Linux.

Registering Spacewalk 2.x/Red Hat Satellite 5.x clients to Uyuni as Salt
minions

If a client machine is running the Red Hat Satellite 5.x agent, registering it
to Uyuni as a Salt minion will fail due to package conflicts.

Registering a RH Satellite 5.x client as a Uyuni traditional client works fine.

Registering a Uyuni traditional client as a Uyuni Salt minion will also work.

                Works                                Fails
RH Satellite 5.x ⇒ Uyuni traditional  RH Satellite 5.x ⇒ Uyuni Salt minion

Uyuni traditional ⇒ Uyuni Salt minion

In order to register Red Hat Satellite 5.x clients to Uyuni as Salt minions,
you will need to modify the bootstrap script to remove the Satellite agent
packages first.

Spacewalk 2.x and Oracle Spacewalk 2.x clients will show the same behavior as
Red Hat Satellite 5.x clients

Ubuntu/Debian: duplicate entries in sources.list

Due to a (bug) in the python3-apt package, a conflict arises with the signed-by
repository option. This issue stems from the interaction between the Salt
aptpkg module, which relies on the aptsources module provided by the python-apt
package.

Presently, the code only recognizes arch and trust options, while any other
valid options cause "aptsources" to classify the repository as invalid. This
can lead to duplicated entries in the /etc/apt/sources.list file on each
highstate run, potentially inflating its size significantly.

Although the patch has been submitted upstream, we are still awaiting its
official release.

In the meanwhile, please vist the SUSE Knowledgebase for more information about
the issue and possible workarounds that also apply to Uyuni.

Client Tools Notes

A quick overview of the URLs of the client tools is available at the following
link.

Supported clients

For an updated overview of supported clients and features please refer to the
official documentation.

Installation

Requirements

See the documentation for more details on the system requirements.

Installing the Server

See the Installation/Upgrade guide for detailed instructions on how to install.

Update from previous versions of Uyuni Server

See the Installation/Upgrade guide for detailed instructions on how to upgrade.

All connected clients will continue to run and are manageable unchanged.

Update from previous versions of Uyuni Proxy

When updating, always start with the server first and then continue with the
proxies.

See the release notes for the proxy and the Installation/Upgrade guide for
detailed upgrade instructions.

Other information

Red Hat Channels

Managing RHEL clients requires availability of appropriate Red Hat packages.

SUSE Channels

Managing SUSE Linux clients requires availability of appropriate SUSE channels.

Your licensed SUSE products can be used with Uyuni by following the setup
Wizard.

Check the manuals for more information.

Providing feedback

In case of encountering a bug please report it at https://github.com/
uyuni-project/uyuni/issues

Legal Notices

Copyright © 2018 – 2026 The Uyuni Project. Uyuni Project is part of openSUSE
Project

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
License. To view a copy of this license, visit http://creativecommons.org/
licenses/by-sa/3.0/es/ or send a letter to Creative Commons, PO Box 1866,
Mountain View, CA 94042, USA.

For SUSE trademarks, see http://www.suse.com/company/legal/. All other
third-party trademarks are the property of their respective owners. Trademark
symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks (*)
denote third-party trademarks.

All information found in this document has been compiled with utmost attention
to detail. However, this does not guarantee complete accuracy. Neither SUSE
LLC, its affiliates, the authors nor the translators shall be held liable for
possible errors or the consequences thereof.

Last updated 2026-08-07 17:58:14 +0200
