RHSA-2026:73655HighCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
September 30, 2026
Last Modified
September 30, 2026

🔗 CVE IDs covered (3)

CVE-2026-81842 →CVE-2026-93981 →CVE-2026-76154 →

📋 Description

CVE-2026-76154 — grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation CVE-2026-81842 — grafana: grafana: Authorization bypass via missing destination folder permission check CVE-2026-93981 — hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.5.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, disable the Geomap plugin. This can be achieved by setting `disable_plugins = geomap` in the `[plugins]` section of the `grafana.ini` configuration file, or by setting the environment variable `GF_PLUGINS_DISABLE_PLUGINS=geomap`. A restart of the Grafana service is required for the changes to take effect. Disabling the plugin will remove the Geomap panel and may affect existing dashboards that utilize it. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)