Red Hat Security AdvisoryRHSA-2026:91181
Red Hat Hardened Images RPMs Security Update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images grafana13.1-13.1.8-0.5.hum1@aarch64, grafana13.1-13.1.8-0.5.hum1@s390x, grafana13.1-13.1.8-0.5.hum1@src +1
Fixes 7 records
Priority MEDIUM 40
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization).
CVSS 4.0HIGH 8.9· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2026-10-28 · Partial fix CWE-285
Priority LOW 39
body-parser is body parsing middleware for Node.js and Express.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00388 · Published 2026-10-22 · Fixed in 2.4.0, 1.20.9 CWE-248
Priority LOW 27
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0025 · Published 2026-10-20 · Partial fix · 2.4.8, 3.1.9 +1 CWE-172
Priority LOW 26
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab provi…
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00161 · Published 2026-10-28 · Partial fix · 12.4.11, 13.0.9 +2 CWE-532
Priority LOW 22
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.00255 · Published 2026-10-20 · Partial fix · 2.4.8, 3.1.9 +1 CWE-20
Priority LOW 17
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00302 · Published 2026-10-20 · Partial fix · 2.4.8, 3.1.9 +1 CWE-116
Priority LOW 17
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00289 · Published 2026-10-20 · Partial fix · 2.4.8, 3.1.9 +1 CWE-41
THREATIST.IORead the docs