Skip to content
OpenAdvisories
High RHSA-2026:87077 13 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.8-0.3.hum1

Vulnerabilities 13

  • High 8.2
    CVE-2026-100349

    kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes valid…

    getkin kin-openapi grafana-13.0 github.com/getkin/kin-openapi Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100352

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote u…

    getkin kin-openapi kubevela-vela-cli kubevela-vela-core Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100353

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote cl…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100354

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document va…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.4
    CVE-2026-100351

    kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a diff…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • Medium 6.7
    CVE-2026-92539

    Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

    A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise ins…

    Grafana Grafana Enterprise grafana-12.3 Web / CMS Wolfi
  • Medium 6.5
    CVE-2026-15577

    Git Sync connection configuration can be modified with read-only access

    A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • Medium 6.5
    CVE-2026-33374

    Unbounded memory allocation in the Prometheus rule conversion API

    The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi
  • Medium 6.3
    CVE-2026-93294

    Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

    A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 5.3
    CVE-2026-100347

    kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. …

    getkin kin-openapi kubevela-vela-cli kubevela-vela-core Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-100348

    kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-110816

    qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

    ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…

    ljharb qs renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 5.3
    CVE-2026-95502

    Git Sync memory exhaustion via a malicious Git server

    A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync…

    Grafana Grafana OSS Grafana Enterprise Nanogit Web / CMS

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-100347
  • report
    https://access.redhat.com/security/cve/CVE-2026-100348
  • report
    https://access.redhat.com/security/cve/CVE-2026-100349
  • report
    https://access.redhat.com/security/cve/CVE-2026-100351
  • report
    https://access.redhat.com/security/cve/CVE-2026-100352
  • report
    https://access.redhat.com/security/cve/CVE-2026-100353
  • report
    https://access.redhat.com/security/cve/CVE-2026-100354
  • report
    https://access.redhat.com/security/cve/CVE-2026-110816
  • report
    https://access.redhat.com/security/cve/CVE-2026-15577
  • report
    https://access.redhat.com/security/cve/CVE-2026-33374
  • report
    https://access.redhat.com/security/cve/CVE-2026-93294
  • report
    https://access.redhat.com/security/cve/CVE-2026-95502
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-92539
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550704
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-15577
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-15577
  • article
    https://grafana.com/security/security-advisories/cve-2026-15577
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550703
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33374
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33374
  • article
    https://grafana.com/security/security-advisories/cve-2026-33374
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556381
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-92539
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-92539
  • article
    https://grafana.com/security/security-advisories/cve-2026-92539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550715
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93294
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93294
  • article
    https://grafana.com/security/security-advisories/cve-2026-93294
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550709
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-95502
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-95502
  • article
    https://grafana.com/security/security-advisories/cve-2026-95502
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100347