Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 1

Vulnerabilities 4

• High 7.3
  CVE-2026-9029

  Stored XSS in the Geomap panel tile-layer attribution

  A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

  Grafana Grafana OSS grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Jun 22, 2026
• Medium 5.4
  CVE-2026-10601

  Path traversal in the Tempo and Loki data source plugins

  A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trig…

  Grafana Grafana OSS github.com/grafana/grafana grafana Web / CMS Alpine Go
  Jun 22, 2026
• Medium 5.1
  CVE-2026-75838

  DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

  DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitizati…

  cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  Aug 18, 2026
• Low 3.7
  CVE-2026-90771

  joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

  joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype…

  hapijs joi opensearch-dashboards-3 thingsboard-tb-js-executor Wolfi npm
  Sep 13, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-90771
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-9029
• report
  https://access.redhat.com/security/cve/CVE-2026-10601
• report
  https://access.redhat.com/security/cve/CVE-2026-75838
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491346
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9029
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9029
• article
  https://grafana.com/security/security-advisories/cve-2026-9029
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491359
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-10601
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-10601
• article
  https://grafana.com/security/security-advisories/cve-2026-10601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-75838
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-75838
• article
  https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
• article
  https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532688
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90771
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90771
• article
  https://github.com/hapijs/joi
• article
  https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
• article
  https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb
• article
  https://github.com/hapijs/joi/issues/3150
• article
  https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages