Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 1

Vulnerabilities 4

• High 7.3
  CVE-2026-9029

  Stored XSS in the Geomap panel tile-layer attribution

  A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

  Grafana Grafana OSS grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Jun 22, 2026
• Medium 5.4
  CVE-2026-10601

  Path traversal in the Tempo and Loki data source plugins

  A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trig…

  Grafana Grafana OSS github.com/grafana/grafana grafana Web / CMS Alpine Go
  Jun 22, 2026
• Medium 5.3
  CVE-2026-61709

  OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

  OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the b…

  openfga openfga grafana-12.3 grafana-12.4 Wolfi Go
  Sep 16, 2026
• Low 3.7
  CVE-2026-90771

  joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

  joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype…

  hapijs joi opensearch-dashboards-3 thingsboard-tb-js-executor Wolfi npm
  Sep 13, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-90771
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-9029
• report
  https://access.redhat.com/security/cve/CVE-2026-10601
• report
  https://access.redhat.com/security/cve/CVE-2026-61709
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491346
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9029
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9029
• article
  https://grafana.com/security/security-advisories/cve-2026-9029
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491359
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-10601
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-10601
• article
  https://grafana.com/security/security-advisories/cve-2026-10601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535473
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-61709
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-61709
• article
  https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• article
  https://github.com/openfga/openfga/releases/tag/v1.18.1
• article
  https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532688
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90771
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90771
• article
  https://github.com/hapijs/joi
• article
  https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
• article
  https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb
• article
  https://github.com/hapijs/joi/issues/3150
• article
  https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages