Skip to content
OpenAdvisories
Medium RHSA-2026:84422 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 18, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.12-0.5.hum1

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-15577

    Git Sync connection configuration can be modified with read-only access

    A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • Medium 6.5
    CVE-2026-33374

    Unbounded memory allocation in the Prometheus rule conversion API

    The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi
  • Medium 5.3
    CVE-2026-109955

    Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

    Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router ma…

    honojs hono hono npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-109955
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-15577
  • report
    https://access.redhat.com/security/cve/CVE-2026-33374
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84422.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550704
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-15577
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-15577
  • article
    https://grafana.com/security/security-advisories/cve-2026-15577
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550703
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33374
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33374
  • article
    https://grafana.com/security/security-advisories/cve-2026-33374
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550544
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109955
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109955
  • article
    https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7
  • article
    https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding