RHSA-2026:68926HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 18, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (4)

CVE-2026-92599 →CVE-2026-14199 →CVE-2026-81871 →CVE-2026-81872 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-81871 — go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration CVE-2026-81872 — go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission CVE-2026-92599 — joi: joi: Denial of Service via isoDate validation regular expression

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.2.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.2.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: To mitigate this vulnerability, ensure that any input strings processed by the `Joi.string().isoDate()` validation rule are capped in length before being passed to the 'joi' package. This can prevent the regular expression engine from consuming excessive resources and causing a denial of service.

🔗 References (8)