Skip to content
OpenAdvisories
High RHSA-2026:68143 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 22, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.10-0.4.hum1

Vulnerabilities 3

  • High 7.3
    CVE-2026-9029

    Stored XSS in the Geomap panel tile-layer attribution

    A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

    Grafana Grafana OSS grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 5.4
    CVE-2026-10601

    Path traversal in the Tempo and Loki data source plugins

    A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trig…

    Grafana Grafana OSS github.com/grafana/grafana grafana Web / CMS Alpine Go
  • Medium 4.8
    CVE-2026-86472

    fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

    fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-enc…

    fast-uri fast-uri prism jupyter-base-notebook Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-86472
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-9029
  • report
    https://access.redhat.com/security/cve/CVE-2026-10601
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68143.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491346
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9029
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9029
  • article
    https://grafana.com/security/security-advisories/cve-2026-9029
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491359
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10601
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10601
  • article
    https://grafana.com/security/security-advisories/cve-2026-10601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533679
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-86472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-86472
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj