RHSA-2026:72498HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 28, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (2)

CVE-2026-61709 →CVE-2026-63209 →

📋 Description

CVE-2026-61709 — github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users. CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.4.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: No product-side mitigation is required while Zanzana remains disabled, which is the default. If Zanzana has been turned on, do not use ListUsers results as an access-control decision; use Check for each user and object until Grafana vendors OpenFGA 1.18.1 or later.

🔗 References (8)