Skip to content
OpenAdvisories
High RHSA-2026:65157 7 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 9, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.10-0.1.hum1

Vulnerabilities 7

  • High 7.5
    CVE-2026-33382

    Denial of service via unbounded request body size

    Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of…

    Grafana Grafana OSS grafana Web / CMS Alpine
  • High 7.1
    CVE-2026-17183

    CVE-2026-17183 CVE Record

    An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data ac…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine
  • High 7.1
    CVE-2026-9765

    CVE-2026-9765 CVE Record

    Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web a…

    Grafana Grafana IRM Web / CMS
  • Medium 6.8
    CVE-2026-17033

    CVE-2026-17033 CVE Record

    An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana …

    Grafana Grafana OSS grafana-12.3 grafana-12.4 Web / CMS Wolfi
  • Medium 6.8
    CVE-2026-8595

    Stored XSS in the table panel (TableNG)

    A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

    Grafana Grafana OSS grafana Web / CMS Alpine
  • Medium 5.3
    CVE-2026-21723

    CVE-2026-21723 Record

    The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very lo…

    Grafana Grafana OSS Web / CMS
  • Medium 5.3
    CVE-2026-8609

    Pre-authentication denial of service via the OAuth login route

    An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

    Grafana Grafana OSS grafana Web / CMS Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-17033
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-21723
  • report
    https://access.redhat.com/security/cve/CVE-2026-9765
  • report
    https://access.redhat.com/security/cve/CVE-2026-8595
  • report
    https://access.redhat.com/security/cve/CVE-2026-33382
  • report
    https://access.redhat.com/security/cve/CVE-2026-8609
  • report
    https://access.redhat.com/security/cve/CVE-2026-17183
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65157.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-8595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-8595
  • article
    https://grafana.com/security/security-advisories/cve-2026-8595
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499061
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-8609
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-8609
  • article
    https://grafana.com/security/security-advisories/cve-2026-8609
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506730
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9765
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9765
  • article
    https://grafana.com/security/security-advisories/cve-2026-9765
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521910
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17033
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17033
  • article
    https://grafana.com/security/security-advisories/cve-2026-17033
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519801
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17183
  • article
    https://grafana.com/security/security-advisories/cve-2026-17183
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506342
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-21723
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-21723
  • article
    https://grafana.com/security/security-advisories/cve-2026-21723
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499062
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33382
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33382
  • article
    https://grafana.com/security/security-advisories/cve-2026-33382