RHSA-2026:93601HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
November 2, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (5)

CVE-2026-110289 →CVE-2026-115754 →CVE-2026-115897 →CVE-2026-116591 →CVE-2026-116689 →

📋 Description

CVE-2026-110289 — grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES CVE-2026-115754 — serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization CVE-2026-115897 — serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input CVE-2026-116689 — follow-redirects: follow-redirects: Information disclosure via cross-origin redirects

🎯 Affected products4

  • Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.6.hum1@aarch64 as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.6.hum1@src as a component of Red Hat Hardened Images
  • grafana12.4-0:12.4.13-0.6.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Audit existing Git Sync and OAuth connector configurations within the Grafana administrative interface to verify that all connection URLs point exclusively to trusted, external repositories rather than loopback or internal network destinations. Additionally, enforce egress network filtering on the host or container network to restrict outbound traffic from the Grafana process to internal subnets and local loopback addresses, allowing connections only to verified Git server hosts. Caveat: Restricting outbound network traffic may disrupt legitimate connections to internal data sources, alert endpoints, or local authentication providers if network filtering rules are overly restrictive. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (14)