Red Hat Security Advisory

RHSA-2026:65157

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana12.4-12.4.10-0.1.hum1@aarch64, grafana12.4-12.4.10-0.1.hum1@src, grafana12.4-12.4.10-0.1.hum1@x86_64

Fixes 7 records

TI-2026-25780 CVE-2026-33382 · GHSA-xcrv-g5fh-9wx2

Denial of service via unbounded request body size

LOW 39

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2026-07-10 Partial fix CWE-400

TI-2026-07565 CVE-2026-8609 · GHSA-j7jj-549c-j492

Pre-authentication denial of service via the OAuth login route

LOW 39

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-07-10 Partial fix CWE-400

TI-2026-14269 CVE-2026-17183 · GHSA-f74r-h7qj-c63f

CVE-2026-17183 CVE Record

LOW 31

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2026-08-19 Partial fix · 12.3.11, 12.4.9 +2 CWE-863

TI-2026-08557 CVE-2026-9765 · GHSA-4cgr-9q8v-9x3m

CVE-2026-9765 CVE Record

LOW 31

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-24 Fixed CWE-284

TI-2026-07553 CVE-2026-8595 · GHSA-hhhx-wxgr-pj4r

Stored XSS in the table panel (TableNG)

LOW 30

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.0024 Published 2026-07-10 Fixed CWE-79

TI-2026-14180 CVE-2026-17033 · GHSA-7vc5-9278-236p

CVE-2026-17033 CVE Record

LOW 29

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00218 Published 2026-08-24 Partial fix CWE-79

TI-2026-17496 CVE-2026-21723 · GHSA-xcrm-48rh-35pj

CVE-2026-21723 Record

LOW 23

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-07-23 Partial fix CWE-400