Red Hat Security Advisory

RHSA-2026:68926

Red Hat Hardened Images RPMs Security Update

Released 2026-09-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.1-13.1.6-0.2.hum1@aarch64, grafana13.1-13.1.6-0.2.hum1@src, grafana13.1-13.1.6-0.2.hum1@x86_64

Fixes 4 records

TI-2026-56486 CVE-2026-81872 · GHSA-hjf4-fphr-2h65

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

MEDIUM 61

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00383 Published 2026-09-16 Partial fix · 0.21.0 CWE-400

TI-2026-62455 CVE-2026-92599 · GHSA-mrx9-2rrp-rhpx

Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

MEDIUM 44

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00582 Published 2026-09-16 Partial fix · 17.13.7, 18.2.6 CWE-1333

TI-2026-12030 CVE-2026-14199 · GHSA-9758-8g25-vw94

Session takeover via Auth Proxy cache key collision

LOW 37

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00325 Published 2026-09-02 Partial fix CWE-1023

TI-2026-56485 CVE-2026-81871 · GHSA-w34q-cm8f-9c5x

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

LOW 27

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00196 Published 2026-09-16 Partial fix · 0.21.0 CWE-295