Read the docs
Red Hat Security Advisory

RHSA-2026:63165

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2026-25780 CVE-2026-33382 · GHSA-xcrv-g5fh-9wx2

Denial of service via unbounded request body size

Priority LOW 39

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2026-07-10 Partial fix CWE-400
TI-2026-07565 CVE-2026-8609 · GHSA-j7jj-549c-j492

Pre-authentication denial of service via the OAuth login route

Priority LOW 39

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-07-10 Partial fix CWE-400
TI-2026-08557 CVE-2026-9765 · GHSA-4cgr-9q8v-9x3m

CVE-2026-9765 CVE Record

Priority LOW 31

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-24 Fixed CWE-284
TI-2026-07553 CVE-2026-8595 · GHSA-hhhx-wxgr-pj4r

Stored XSS in the table panel (TableNG)

Priority LOW 30

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.0024 Published 2026-07-10 Fixed CWE-79
TI-2026-14180 CVE-2026-17033 · GHSA-7vc5-9278-236p

CVE-2026-17033 CVE Record

Priority LOW 29

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00218 Published 2026-08-24 Partial fix CWE-79
TI-2026-15674 CVE-2026-19197 · GHSA-ccq3-xjc6-g2c3

Broken access control in dashboard snapshots

Priority LOW 27

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00154 Published 2026-08-26 Partial fix · 12.4.8, 13.0.6 +1 CWE-862
TI-2026-17496 CVE-2026-21723 · GHSA-xcrm-48rh-35pj

CVE-2026-21723 Record

Priority LOW 23

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-07-23 Partial fix CWE-400