Red Hat Security Advisory

RHSA-2026:76448

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.1-13.1.7-0.1.hum1@aarch64, grafana13.1-13.1.7-0.1.hum1@src, grafana13.1-13.1.7-0.1.hum1@x86_64

Fixes 8 records

TI-2026-74661 CVE-2026-97394 · GHSA-p6wj-qrr4-pgh5

kin-openapi nil pointer panic in openapi3filter on array schemas without items

HIGH 72

kin-openapi is a Go project for handling OpenAPI files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-10-15 Fixed in 0.143.0 CWE-248

TI-2026-71819 CVE-2026-101899

Axios ignores CIDR NO_PROXY entries and routes traffic through proxy

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00512 Published 2026-10-13 Fixed in 1.20.0 CWE-693

TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

MEDIUM 41

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2024-03-05 Partial fix · 1.33.0 CWE-835

TI-2026-69257 CVE-2026-56851 · GHSA-gx9w-9qq8-m485

Panic in golang.org/x/text Nickname profile parsing crafted input

LOW 39

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00466 Published 2026-10-07 Partial fix · 0.41.0 CWE-787

TI-2026-56466 CVE-2026-81841 · GHSA-4jjr-w7m9-wx5q

Paused shared dashboard access tokens still expose data source configuration

LOW 30

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0038 Published 2026-09-29 Partial fix · 12.4.12, 13.0.10 +2 CWE-862

TI-2026-69611 CVE-2026-61801 · GHSA-mjcv-p78q-w5fw

Unbounded parsing in moby/sys/user lets attackers exhaust memory

LOW 24

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00117 Published 2026-10-08 Partial fix · 0.4.1 CWE-400

TI-2026-11566 CVE-2026-13720 · GHSA-9q62-r26p-xcjv

Editor can forge file-provisioning provenance on dashboards via the dashboard API

LOW 24

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00157 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-285

TI-2026-11565 CVE-2026-13719 · GHSA-46f2-3vm3-9h7j

Alert rules in restricted folders disclosed via the alert rules list API

LOW 20

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-200