openSUSE Patches Agama Installer After More Bundled Rust Crate Flaws Reach Leap 16
openSUSE has published openSUSE-SU-2026:22075-1, an important-rated update for agama, the installation framework shipped with openSUSE Leap 16.0, resolving two vulnerabilities alongside six bug fixes. The headline item is CVE-2026-25541 in the bundled bytes crate, which SUSE scores 7.5 under CVSS 3.1 and 8.7 under CVSS 4.0 with a high availability impact. The update also carries CVE-2025-58160 in tracing-subscriber, scored 3.1 and 2.3, plus a third bundled crate issue in serde_with tracked only as GHSA-7gcf-g7xr-8hxj. All three are flaws inherited from bundled Rust dependencies rather than defects in agama's own code.
The advisory does not publish exploitation details for either CVE, and the remedy is a dependency bump rather than a change to agama's own code: bytes moves to 1.12.1, tracing-subscriber to 0.3.20 and serde_with to 3.21.0. Because Rust crates are statically linked into the finished binaries, agama had to be rebuilt and republished as 17+699.92879916c-160000.13.1 across all eight subpackages. What the published vectors do say is that CVE-2026-25541 is network-reachable, requires no privileges and no user interaction, and ends in a complete loss of availability. CVE-2025-58160 is far harder to reach, needing user interaction and high attack complexity, and yields only a limited integrity effect with no confidentiality or availability consequence.
Agama matters here because it runs a web server that is deliberately reachable over the network while a system is being provisioned, which is precisely when the host is least monitored. The same release adds the inst.listen_on boot parameter, allows inst.remote=0 to switch remote access off entirely for CC-compliant installation, and replaces the agama-web-server –address2 option with a repeatable –address. On current exploitation status, FIRST EPSS puts CVE-2026-25541 at a 0.6 percent probability of exploitation in the next 30 days and CVE-2025-58160 at 0.3 percent, and no in-the-wild activity is reported for either. The wider exposure is dependency sprawl: these crates sit inside many Rust binaries across the distribution, so further rebuild-only advisories of this shape are likely.
Attack Surface
Server OS, Supply Chain (Third-party vendors), System Management Service
Tactics
Impact, Initial Access
Techniques
- T1195.001 – Compromise Software Dependencies and Development Tools
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Apply the agama patch on openSUSE Leap 16.0 with 'zypper in -t patch openSUSE-Leap-16.0-1888=1', which delivers agama 17+699.92879916c-160000.13.1 and the rebuilt crate dependencies.
- Confirm every agama subpackage was rebuilt, not just the main one, with 'rpm -qa | grep agama' – agama, agama-autoinstall, agama-cli, agama-cli-bash-completion, agama-cli-fish-completion, agama-cli-zsh-completion, agama-openapi and agama-scripts must all read 17+699.92879916c-160000.13.1.
- Rebuild or re-audit any other locally built Rust binaries that statically link bytes below 1.12.1 (CVE-2026-25541), tracing-subscriber below 0.3.20 (CVE-2025-58160) or serde_with below 3.21.0 (GHSA-7gcf-g7xr-8hxj), using 'cargo audit' against each project's Cargo.lock.
- Where installations must be locked down, pass inst.remote=0 at boot to disable agama remote access entirely, as introduced in this release for CC compliant installation.
- For installs that still need remote access, bind the installer with the new inst.listen_on boot parameter to a specific IPv4 or IPv6 address or named interface rather than leaving the agama web server listening on all interfaces.
- Update any provisioning automation that calls agama-web-server with –address2, which has been removed in this build; the –address option is now repeatable and must be used instead or the installer will fail to start.
- Re-test network profiles built before this update for the fixed defects: stale dns-search, address and gateway values retained on disabled IP protocols (bsc#1271644), missing VLAN_FLAG_REORDER_HDR handling on VLAN interfaces (bsc#1271079), and the device match attribute renamed to 'match' (bsc#1271235).
