Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 1

Vulnerabilities 8

• High 7.5
  CVE-2026-33382

  Denial of service via unbounded request body size

  Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of…

  Grafana Grafana OSS grafana Web / CMS Alpine
  Jul 10, 2026
• High 7.5
  CVE-2026-84375

  js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

  js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large seque…

  nodeca js-yaml katib-suggestion-hyperopt renovate Debian Ubuntu Wolfi npm
  Sep 1, 2026
• High 7.1
  CVE-2026-9765

  CVE-2026-9765 CVE Record

  Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web a…

  Grafana Grafana IRM Web / CMS
  Jul 24, 2026
• Medium 6.8
  CVE-2026-17033

  CVE-2026-17033 CVE Record

  An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana …

  Grafana Grafana OSS grafana-12.3 grafana-12.4 Web / CMS Wolfi
  Aug 24, 2026
• Medium 6.8
  CVE-2026-8595

  Stored XSS in the table panel (TableNG)

  A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

  Grafana Grafana OSS grafana Web / CMS Alpine
  Jul 10, 2026
• Medium 6.3
  CVE-2026-19197

  Broken access control in dashboard snapshots

  A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

  Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu
  Aug 26, 2026
• Medium 5.3
  CVE-2026-21723

  CVE-2026-21723 Record

  The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very lo…

  Grafana Grafana OSS Web / CMS
  Jul 23, 2026
• Medium 5.3
  CVE-2026-8609

  Pre-authentication denial of service via the OAuth login route

  An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

  Grafana Grafana OSS grafana Web / CMS Alpine
  Jul 10, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-84375
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-17033
• report
  https://access.redhat.com/security/cve/CVE-2026-19197
• report
  https://access.redhat.com/security/cve/CVE-2026-21723
• report
  https://access.redhat.com/security/cve/CVE-2026-9765
• report
  https://access.redhat.com/security/cve/CVE-2026-8595
• report
  https://access.redhat.com/security/cve/CVE-2026-33382
• report
  https://access.redhat.com/security/cve/CVE-2026-8609
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63165.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499051
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8595
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8595
• article
  https://grafana.com/security/security-advisories/cve-2026-8595
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8609
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8609
• article
  https://grafana.com/security/security-advisories/cve-2026-8609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506730
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9765
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9765
• article
  https://grafana.com/security/security-advisories/cve-2026-9765
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521910
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-17033
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-17033
• article
  https://grafana.com/security/security-advisories/cve-2026-17033
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524303
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19197
• article
  https://grafana.com/security/security-advisories/cve-2026-19197
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506342
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21723
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21723
• article
  https://grafana.com/security/security-advisories/cve-2026-21723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33382
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33382
• article
  https://grafana.com/security/security-advisories/cve-2026-33382