Red Hat Security Advisory

RHSA-2026:67605

Red Hat Hardened Images RPMs Security Update

Released 2026-09-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.2-13.2.1-0.4.hum1@aarch64, grafana13.2-13.2.1-0.4.hum1@src, grafana13.2-13.2.1-0.4.hum1@x86_64

Fixes 4 records

TI-2026-61678 CVE-2026-90771 · GHSA-wr44-6hxh-3jwq

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

MEDIUM 61

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00389 Published 2026-09-13 Partial fix · 17.13.8, 18.2.9 CWE-1321

TI-2026-07936 CVE-2026-9029 · GHSA-9g84-39mm-q4p3

Stored XSS in the Geomap panel tile-layer attribution

LOW 34

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00251 Published 2026-06-22 Fixed in 1.9.2-0.20260616075434-82ef13993059 CWE-79

TI-2026-44173 CVE-2026-61709 · GHSA-g3pg-frfm-pr2m

Incorrect authorization in openfga

LOW 24

OpenFGA is an authorization and permission engine built for developers.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00351 Published 2026-09-16 Partial fix · 1.18.1 CWE-281

TI-2026-09116 CVE-2026-10601 · GHSA-9493-h4f5-633x

Path traversal in the Tempo and Loki data source plugins

LOW 24

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00286 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-22