Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 1

Vulnerabilities 5

• High 7.3
  CVE-2026-76154

  CVE-2026-76154 CVE Record

  A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

  Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  Sep 17, 2026
• Medium 5.4
  CVE-2026-13720

  Editor can forge file-provisioning provenance on dashboards via the dashboard API

  An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The da…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 30, 2026
• Medium 5.3
  CVE-2026-81841

  Paused shared dashboard access tokens still expose data source configuration

  Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's d…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 29, 2026
• Medium 4.3
  CVE-2026-13719

  Alert rules in restricted folders disclosed via the alert rules list API

  An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organizati…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 30, 2026
• Medium 4.3
  CVE-2026-81842

  Library panel can be moved into a folder without library panel create permission

  An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel c…

  Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  Sep 29, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-13720
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-13719
• report
  https://access.redhat.com/security/cve/CVE-2026-81841
• report
  https://access.redhat.com/security/cve/CVE-2026-81842
• report
  https://access.redhat.com/security/cve/CVE-2026-76154
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74164.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543885
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13719
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13719
• article
  https://grafana.com/security/security-advisories/cve-2026-13719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13720
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13720
• article
  https://grafana.com/security/security-advisories/cve-2026-13720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528028
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-76154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-76154
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-81841
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-81841
• article
  https://grafana.com/security/security-advisories/cve-2026-81841
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-81842
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-81842
• article
  https://grafana.com/security/security-advisories/cve-2026-81842