RHSA-2026:67605HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 15, 2026
Last Modified
October 10, 2026

🔗 CVE IDs covered (4)

CVE-2026-9029 →CVE-2026-10601 →CVE-2026-61709 →CVE-2026-90771 →

📋 Description

CVE-2026-9029 — grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel CVE-2026-10601 — grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal CVE-2026-61709 — github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users. CVE-2026-90771 — joi: joi: Prototype Pollution via custom messages

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.4.hum1@src as a component of Red Hat Hardened Images
  • grafana13.2-0:13.2.1-0.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: No product-side mitigation is required while Zanzana remains disabled, which is the default. If Zanzana has been turned on, do not use ListUsers results as an access-control decision; use Check for each user and object until Grafana vendors OpenFGA 1.18.1 or later. Workaround: Upgrade joi to 17.13.8, 18.2.9, or later. Avoid passing untrusted data to Joi message configuration until upgraded.

🔗 References (8)