RHSA-2026:85544MediumCVSS 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 19, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (6)

CVE-2026-15577 →CVE-2026-33374 →CVE-2026-92539 →CVE-2026-93294 →CVE-2026-95502 →CVE-2026-111757 →

📋 Description

CVE-2026-15577 — grafana: Grafana: Unauthorized configuration modification via status subresource CVE-2026-33374 — grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API CVE-2026-92539 — grafana: Grafana: Unauthorized cross-organization user management via the SCIM API CVE-2026-93294 — grafana: Grafana: Information disclosure via Azure Monitor resource proxy CVE-2026-95502 — grafana: grafana: Denial of Service via oversized Git Sync responses CVE-2026-111757 — hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic

🎯 Affected products5

  • Red Hat Hardened Images
  • grafana13.2-0:13.2.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.4-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.4-0.1.hum1@src as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: If Git Sync / experimental provisioning is not required, disable it so the vulnerable status API is not exposed. Restrict Grafana network access to trusted administrators. Minimize identities granted even read access to Git Sync connections and audit connection settings after suspicious activity. Workaround: Restrict access to the Grafana UI and HTTP API to trusted clients and administrative networks. Limit accounts that can authenticate to Grafana and review roles that can use alerting or Prometheus rule conversion APIs. Apply process or cgroup memory limits to reduce out-of-memory blast radius. Workaround: Not applicable to Red Hat product builds, which do not ship Grafana Enterprise SCIM. If you run upstream Grafana Enterprise with SCIM, restrict SCIM and user-management credentials to highly trusted service accounts, isolate the Grafana management plane. Prefer separate Grafana instances per tenant when strong isolation is required. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not point Git Sync at untrusted Git servers; use only trusted repositories and credentials. Restrict who can configure Git Sync and limit Grafana management-plane network exposure (https://cmetaxonomy.org/entries/CME-202.html, https://cmetaxonomy.org/entries/CME-203.html). Apply process or cgroup memory limits to contain memory-exhaustion impact (https://cmetaxonomy.org/entries/CME-114.html, https://cmetaxonomy.org/entries/CME-704.html). Upgrade affected Grafana 13.x builds to a fixed release (13.0.11, 13.1.8, or 13.2.4 as applicable).

🔗 References (10)