RHSA-2026:68777MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 17, 2026
Last Modified
October 10, 2026

🔗 CVE IDs covered (2)

CVE-2026-61709 →CVE-2026-81871 →

📋 Description

CVE-2026-61709 — github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users. CVE-2026-81871 — go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana12.4-0:12.4.10-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.10-0.5.hum1@src as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.10-0.5.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: No product-side mitigation is required while Zanzana remains disabled, which is the default. If Zanzana has been turned on, do not use ListUsers results as an access-control decision; use Check for each user and object until Grafana vendors OpenFGA 1.18.1 or later.

🔗 References (6)