Red Hat Security Advisory

RHSA-2026:68143

Red Hat Hardened Images RPMs Security Update

Released 2026-09-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana12.4-12.4.10-0.4.hum1@aarch64, grafana12.4-12.4.10-0.4.hum1@src, grafana12.4-12.4.10-0.4.hum1@x86_64

TI-2026-07936 CVE-2026-9029 · GHSA-9g84-39mm-q4p3

LOW 34

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00251 Published 2026-06-22 Fixed in 1.9.2-0.20260616075434-82ef13993059 CWE-79

TI-2026-09116 CVE-2026-10601 · GHSA-9493-h4f5-633x

LOW 24

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00286 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-22

TI-2026-59166 CVE-2026-86472 · GHSA-hrr3-gc8f-f4qj

LOW 22

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00253 Published 2026-09-15 Partial fix · 2.4.7, 3.1.8 +1 CWE-178