Skip to content
OpenAdvisories
Medium RHSA-2026:85295 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 20, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.13-0.1.hum1

Vulnerabilities 3

  • Medium 6.7
    CVE-2026-92539

    Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

    A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise ins…

    Grafana Grafana Enterprise grafana-12.3 Web / CMS Wolfi
  • Medium 6.3
    CVE-2026-93294

    Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

    A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 5.3
    CVE-2026-111757

    Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix.…

    honojs hono

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-93294
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-111757
  • report
    https://access.redhat.com/security/cve/CVE-2026-92539
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85295.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556381
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-92539
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-92539
  • article
    https://grafana.com/security/security-advisories/cve-2026-92539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550715
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93294
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93294
  • article
    https://grafana.com/security/security-advisories/cve-2026-93294
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555734
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111757
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111757
  • article
    https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc
  • article
    https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7