RHSA-2026:67573HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 15, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (4)

CVE-2026-9029 →CVE-2026-10601 →CVE-2026-75838 →CVE-2026-90771 →

📋 Description

CVE-2026-9029 — grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel CVE-2026-10601 — grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-90771 — joi: joi: Prototype Pollution via custom messages

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.3-0.9.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.3-0.9.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.3-0.9.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: Upgrade joi to 17.13.8, 18.2.9, or later. Avoid passing untrusted data to Joi message configuration until upgraded.

🔗 References (8)