RHSA-2026:4782HighCVSS 8.2

Red Hat Security Advisory: Cluster Observability Operator 1.4.0

Published
March 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2025-13465 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions

🎯 Affected products82

  • Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:6a501530cb199e9c994af273fc28df7cbd3621690cce9034cbe09ce305bf13c0_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:85cd87f5b8da4dd781d18c415a9e07c88a5c9d09a1ea1a2b645fde99de8c5b4d_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:cf18edb2ae50ebb860d5a84b0395218d55df0e1ddedc6eacf9e7cdf001ccab5e_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:e48c15182f306c70022f3b9e3adec595df8a92fc585be2a784d7c5996a4544e3_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:3ddfa0d765410437243d8776c56b3938633f0f24b3c584ee7e8d9f22838bc21e_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:746c59c5bdd1e8c0c43c9f484145ffcd92b536e4b5639c462f64045a963bcb22_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:93d87d23965c16156f9c2a8b9580652254f7c17654e42a117ff5585dcec26a56_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:9b6ea51f93606e6a213abc4b52764646e2029aef083c3733a5ab8cfd151f86c2_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:0415e8263a185c51897bcd5d3ac2f5fe68e4818282a2f9dc89f215ee3b9dd1ed_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:56e8d9fc3e6217dd05cbefdd890fd5faf962e2b2285e53d03bce75b9ec9aab72_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:8294b2024310f0d820598dcbb439367182a417f5d3d451518d9b6b3ec92f7c68_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:a78261282ead47a4f34e24919828c23c62f0fb51f77e8995bc02ca79cc09ad66_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:c92cc6211a0dab55a8e0c47d6bc5d3917dd6c0f74f2bb5c1a277a213c2dfec52_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:3399090ef97bf62333cb4b50bc1bd8c4e0b8cdc00b1170fe90643c0cbd343639_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:4d369837c8e0a4991db1a1793c5f591793893eb94f590edc8031746d57fee2f6_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:9544e59f00654643de06d0e2f03017deb7bf8f5aa077222320cd7670104246bf_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:c36bf22f32ba53c3a937671c345a5c4b82ccdbae3b07a2345af99eec34ebb1c9_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:0cf2c30f35d4944c0396a86c7b852cb0d9b88d8f4f188d57eeb29e570f957767_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:1b994e1d6aa875327661edf19a47cd6ef7f7613c9313b69e5fba60bbb5ed098b_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:5bfc036a1fdee2c83123fee652fd332336e68a75ce2c5b59f568b53863327ab9_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:8f84e1a2f8ec059c6e441a57908a4cdcc76b75d46b7306392d350003aa1d2a37_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:778df37dd74dd32dd6aaad6e1a6394dfc3b6776750d346d716f0c28a016c4b7f_arm64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:92b15a37801dcc4e14715f24b4e59a94c8cda7bc0fd4bd63abc53b1e62797fe7_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:d1534aa5874aa20328ffdac4a444c62fe4be8397aa01c5f0b092854937984a1e_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:eb37c320bee1cd8f8d740fe74f19b8fa88557318fdf5d3918b01e85aee936512_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:1ab07c2cde28e280a93aad305aa93fe5bd297c8ebe458d76b7e545d4c632ca89_ppc64le as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:ca8b272ea1f95013b2b359affabaafdbabbd50c48ea50bc2acaf0fbdd3a4de2b_amd64 as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:e7805585ebc3c12e8dc07f1347a8a433facb8f69efd24c845ad26bdc2d51916d_s390x as a component of Cluster Observability Operator 1.4.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-rhel9@sha256:fbba7f838d175308ce2cc08e18ab1abe270b1a00b254ac40edb2ff6fc78ad519_arm64 as a component of Cluster Observability Operator 1.4.0
  • +52 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.

🔗 References (6)