Red Hat Security Advisory

RHSA-2026:74164

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana12.4-12.4.12-0.2.hum1@aarch64, grafana12.4-12.4.12-0.2.hum1@src, grafana12.4-12.4.12-0.2.hum1@x86_64

Fixes 5 records

TI-2026-53275 CVE-2026-76154 · GHSA-35gc-393c-vjxf

CVE-2026-76154 CVE Record

LOW 34

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuratio…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00353 Published 2026-09-17 Partial fix CWE-79

TI-2026-56466 CVE-2026-81841 · GHSA-4jjr-w7m9-wx5q

Paused shared dashboard access tokens still expose data source configuration

LOW 30

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0038 Published 2026-09-29 Partial fix · 12.4.12, 13.0.10 +2 CWE-862

TI-2026-11566 CVE-2026-13720 · GHSA-9q62-r26p-xcjv

Editor can forge file-provisioning provenance on dashboards via the dashboard API

LOW 24

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00157 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-285

TI-2026-11565 CVE-2026-13719 · GHSA-46f2-3vm3-9h7j

Alert rules in restricted folders disclosed via the alert rules list API

LOW 20

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-200

TI-2026-56467 CVE-2026-81842 · GHSA-37j9-5rxj-3hwp

Library panel can be moved into a folder without library panel create permission

LOW 19

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00198 Published 2026-09-29 Partial fix · 12.4.12, 13.0.10 CWE-863