Home / mailings

PDF

[USN-8914-1] Google Guest Agent, Google OS Config Agent vulnerability

Posted on 12 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8914-1
October 12, 2026

google-guest-agent, google-osconfig-agent vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

Google Guest Agent and Google OS Config Agent could allow unintended
access to network services.

Software Description:
- google-guest-agent: Google Compute Engine Guest Agent
- google-osconfig-agent: Google OS Config Agent

Details:

It was discovered that the Go x/net/idna package, vendored in Google Guest
Agent and Google OS Config Agent, incorrectly accepted Punycode-encoded
labels that decoded to ASCII-only labels when processing internationalized
domain names. A remote attacker could possibly use this issue to bypass
hostname-based access controls and escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
google-guest-agent 20250116.00-0ubuntu1~22.04.4
google-osconfig-agent 20251028.00-0ubuntu2~22.04.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8914-1
CVE-2026-39821

Package Information:
https://launchpad.net/ubuntu/+source/google-guest-agent/20250116.00-0ubuntu1~22.04.4
https://launchpad.net/ubuntu/+source/google-osconfig-agent/20251028.00-0ubuntu2~22.04.1

--===============2936922691387863704==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP