RHSA-2026:91292HighCVSS 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 27, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (10)

CVE-2026-100352 →CVE-2026-100353 →CVE-2026-100354 →CVE-2026-110180 →CVE-2026-110725 →CVE-2026-79656 →CVE-2026-103506 →CVE-2026-110095 →CVE-2026-110306 →CVE-2026-111181 →

📋 Description

CVE-2026-79656 — grafana: OAuth and OIDC tokens written unredacted to Grafana server logs CVE-2026-100352 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values CVE-2026-100353 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding CVE-2026-100354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation CVE-2026-103506 — grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled CVE-2026-110095 — fast-uri: fast-uri: Path traversal via improper relative URI normalization CVE-2026-110180 — fast-uri: fast-uri: Security policy bypass via improper host canonicalization CVE-2026-110306 — fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding CVE-2026-110725 — fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths CVE-2026-111181 — body-parser: body-parser: Denial of Service via unhandled decompression stream error

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.5.hum1@src as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.5.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, restrict read access to Grafana server logs and any downstream log pipelines. Additionally, minimize the scopes granted to the Grafana OAuth client to limit the potential impact of leaked tokens. If your identity provider issues long-lived or non-expiring tokens, consider rotating the Grafana OAuth client secret and revoking issued tokens at the provider. Workaround: Ensure the experimental `kubernetesSsoSettingsApi` feature toggle is disabled. By default, this feature toggle is inactive. If this feature was manually activated, remove `kubernetesSsoSettingsApi` from the `[feature_toggles]` section in the Grafana configuration file (`grafana.ini`) or from the `GF_FEATURE_TOGGLES_ENABLE` environment variable. Apply the configuration by restarting the service: ``` systemctl restart grafana-server ``` Warning: Restarting the `grafana-server` service will result in a temporary interruption of service for connected users. Additionally, if the toggle was previously enabled, immediately rotate all associated SSO client secrets to prevent unauthorized access from potentially exposed credentials. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (14)