Skip to content
OpenAdvisories
Medium RHSA-2026:85544 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.2 0:13.2.4-0.1.hum1

Vulnerabilities 4

  • Medium 6.5
    CVE-2026-15577

    Git Sync connection configuration can be modified with read-only access

    A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • Medium 6.5
    CVE-2026-33374

    Unbounded memory allocation in the Prometheus rule conversion API

    The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi
  • Medium 6.3
    CVE-2026-93294

    Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

    A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 5.3
    CVE-2026-95502

    Git Sync memory exhaustion via a malicious Git server

    A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync…

    Grafana Grafana OSS Grafana Enterprise Nanogit Web / CMS

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-15577
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-33374
  • report
    https://access.redhat.com/security/cve/CVE-2026-95502
  • report
    https://access.redhat.com/security/cve/CVE-2026-93294
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85544.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550704
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-15577
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-15577
  • article
    https://grafana.com/security/security-advisories/cve-2026-15577
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550703
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33374
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33374
  • article
    https://grafana.com/security/security-advisories/cve-2026-33374
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550715
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93294
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93294
  • article
    https://grafana.com/security/security-advisories/cve-2026-93294
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550709
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-95502
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-95502
  • article
    https://grafana.com/security/security-advisories/cve-2026-95502