openSUSE 16 Security Update : rqlite (openSUSE-SU-2026:22224-1)

high Nessus Plugin ID 376249

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22224-1 advisory.

Changes in rqlite:

- Update to version 10.6.6:
* Keep the local auto-backup file if the metadata rename fails
* Reject local auto-backup filenames reserved for internal use
* POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster.
* DELETE /remove returns a JSON error body.
- Includes changes from version 10.6.5:
* Guard the inter-node backup stream handler directly against a missing backup request
* POST /leader returns a JSON error body, and 404 when the target node is not in the cluster

- Update to version 10.6.4:
* BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934)
* GET /leader returns a JSON error body when there is no leader
* Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway
* Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command

- Update to version 10.6.3:
* Node probes honor request context and commit exactly one result
* Make DB connections a first-class object
* Prevent ATTACH on the query database connection

- Update to version 10.6.2:
* Check for trailing junk in request bodies
* Console schema view handles table names that collide with JavaScript object properties
* Set CommitTimestamps in CDC Events Group
* Upgrade dependencies

- Update to version 10.6.1:
* Use constant-time comparison when comparing passwords
* Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens
* More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording
* CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects
* Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun)
* Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):
vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
* Package is not affected by CVE-2026-89090 (boo#1280657):
vendored eventstream is v1.7.20, above the v1.7.8 fix
* Package is not affected by CVE-2026-63209 (boo#1283555):
vendored klauspost/compress is v1.20.1, above the v1.18.7 fix
* Package is not affected by CVE-2026-39821 (boo#1266544):
vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix

- Update to version 10.6.0:
* API addition: error_v2 may contain numeric SQLite error codes.
* addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue.
* multiple implementation changes and bug fixes
* Display interactive cluster topology on web console.
* Support configurable queued-writes retries
* release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling

- Update to version 10.3.6:
* Add query logging to database layer
* Snapshot IDs now contain (optional) generation
* Bump generation ID if snapshot IDs collide
* Snapshots can be filtered by term and index
* Add support for File Renaming and Removing with retries
* Replace standard library with fsutil
* Keep snapshot ordering correct regardless of clock
* Remove snapshot name generation ID

- Update to version 10.3.5:
* Reject alternate form of unsupported PRAGMA commands
* Handle negative trailing logs
* Sync access to last backup time at http layer
* Set the Served by header before first backup byte
* Set DB load response time for all formats
* Fix HTTP logic error for queued statements
* Minor web console fixes
- includes changes from 10.0.4:
* Do not emit rolled-back events over CDC
- includes changes from 10.0.3:
* Refactor busy timeout methods
* Fix edge-case bugs detected by GPT-6 Astra
* Switch to quay.io/minio/minio:latest for testing purposes
* Fix removing a node with different ID, but same Raft address
* Use correct Foreign Key setting when recovering node
* Only dump the indexes and triggers of the selected tables
* Detect DB changes during Request(RETURNING)
* Snapshot Open() first checks for failed reap
* Sync snapshot plan directory
* Propagate WAL stat errors
* Clean up cancelled snapshots
* Reject incomplete snapshot headers
* Validate restore database header
* Only reap a sole fullsnapshot if it has zero WALs
* Keep database dumps consistent during writes to the database
* Roll back DB Requests on statement-prepare errors
- includes changes from 10.0.2:
* Upgrade SQLite driver
* Unit test reaping an installed Snapshot and streamed Snapshot combo
* Use distinct Snapshot Namer type
* Replace breaking-pragma regexes with ASCII prefix scanning
* Consolidate pragma and txStatus reads onto a single connection per pool
* Fix some magic strings in db package

- Update to version 10.3.1:
* Consolidate SQLite driver construction
* Plumb Term and Index through during Snapshot Restore
* Hard exit if FSM Restore fails post database-swap

- Update to version 10.3.0:
* Console app supports quickly querying for first 100 rows of a table
* Rename read-only nodes to read replicas. Command-line flags unchanged
* Bundles dependencies updated
* Add infra for pushing OTLP metrics to an OpenTelemetry Collector
* Add query logging at database level
* Add CopyDir functionality to file utils.
* Add ability to clone Snapshots, primarily for testing purposes
* Store Index and Term in Fingerprint file and check during start-up

- Update to version 10.2.7:
* Remove explicit database-level read-only check from the pure Query path
* Miscellaneous Store-level fixes related to resource management and shutdown sequence
* Don't run CRC checks twice on Snapshot when fast-restart is explicitly disabled
* Fixes to the http package including SQL rewriting control.
* Address potential dropped CDC event on restart
* Various minor fixes
- includes changes from 10.2.6:
* Handle a fully-executed Reap plan, but Plan file itself not removed
* Close Snapshot streamer on error.
- includes changes from 10.2.5:
* Perform a Quick Integrity check after reaping snapshots, not Full

- Update to version 10.2.4:
* Fix some non-AWS S3-compatible stores
- includes changes from 10.2.3
* Check snapshot store integrity before first actual use
* Disable HTTP timeout for boot and restore operations via the shell
* HTTP layer ignores ErrNoWALToSnapshot when snapshotting
* Close Snapshot Streamer ASAP when restoring to local node

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected rqlite package.

Plugin Details

Severity: High

ID: 376249

File Name: openSUSE-2026-22224-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 58.1

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-84303

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-39821

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-84445

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:rqlite

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2026

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-39821, CVE-2026-63209, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445, CVE-2026-89090

Detections

Analytics

openSUSE 16 Security Update : rqlite (openSUSE-SU-2026:22224-1)

high Nessus Plugin ID 376249

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information