RHSA-2026:87077HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 21, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (13)

CVE-2026-100352 →CVE-2026-100353 →CVE-2026-110816 →CVE-2026-93294 →CVE-2026-95502 →CVE-2026-100348 →CVE-2026-100351 →CVE-2026-100354 →CVE-2026-15577 →CVE-2026-33374 →CVE-2026-92539 →CVE-2026-100347 →CVE-2026-100349 →

📋 Description

CVE-2026-15577 — grafana: Grafana: Unauthorized configuration modification via status subresource CVE-2026-33374 — grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API CVE-2026-92539 — grafana: Grafana: Unauthorized cross-organization user management via the SCIM API CVE-2026-93294 — grafana: Grafana: Information disclosure via Azure Monitor resource proxy CVE-2026-95502 — grafana: grafana: Denial of Service via oversized Git Sync responses CVE-2026-100347 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths CVE-2026-100348 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via self-referential schema definitions CVE-2026-100349 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation CVE-2026-100351 — github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy CVE-2026-100352 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values CVE-2026-100353 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding CVE-2026-100354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation CVE-2026-110816 — qs: qs: Denial of Service via unhandled exception during array serialization

🎯 Affected products5

  • Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.3.hum1@s390x as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.3.hum1@src as a component of Red Hat Hardened Images
  • grafana13.1-0:13.1.8-0.3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (17)