Skip to content
OpenAdvisories
Medium RHSA-2026:62527 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 5, 2026 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 tempo2.10 0:2.10.8-0.2.hum1

Vulnerabilities 2

  • Medium 6.8
    CVE-2026-81092

    mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

    mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the hos…

    mark3labs mcp-go
  • Medium 5.4
    CVE-2026-10601

    Path traversal in the Tempo and Loki data source plugins

    A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trig…

    Grafana Grafana OSS github.com/grafana/grafana grafana Web / CMS Alpine Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-81092
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-10601
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62527.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491359
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10601
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10601
  • article
    https://grafana.com/security/security-advisories/cve-2026-10601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2525106
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-81092
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-81092
  • article
    https://github.com/mark3labs/mcp-go
  • article
    https://github.com/mark3labs/mcp-go/pull/921
  • article
    https://github.com/mark3labs/mcp-go/releases/tag/v0.56.0
  • article
    https://www.vulncheck.com/advisories/mcp-go-before-0.56.0-missing-host-header-validation-enables-dns-rebinding