Red Hat Security Advisory

RHSA-2026:67573

Red Hat Hardened Images RPMs Security Update

Released 2026-09-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.1-13.1.3-0.9.hum1@aarch64, grafana13.1-13.1.3-0.9.hum1@src, grafana13.1-13.1.3-0.9.hum1@x86_64

Fixes 4 records

TI-2026-61678 CVE-2026-90771 · GHSA-wr44-6hxh-3jwq

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

MEDIUM 61

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00389 Published 2026-09-13 Partial fix · 17.13.8, 18.2.9 CWE-1321

TI-2026-53084 CVE-2026-75838 · GHSA-748c-f84h-hp2v

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

MEDIUM 56

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00394 Published 2026-08-18 Partial fix · 3.4.13 CWE-79

TI-2026-07936 CVE-2026-9029 · GHSA-9g84-39mm-q4p3

Stored XSS in the Geomap panel tile-layer attribution

LOW 34

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00251 Published 2026-06-22 Fixed in 1.9.2-0.20260616075434-82ef13993059 CWE-79

TI-2026-09116 CVE-2026-10601 · GHSA-9493-h4f5-633x

Path traversal in the Tempo and Loki data source plugins

LOW 24

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00286 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-22