Skip to content
OpenAdvisories
High RHSA-2026:88478 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.13-0.3.hum1

Vulnerabilities 4

  • High 8.7
    CVE-2026-114126

    Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load…

    storybookjs storybook storybook @storybook/core-server npm
  • High 8.6
    CVE-2026-114125

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…

    storybookjs storybook langfuse-3-worker storybook Wolfi npm
  • High 8.2
    CVE-2026-111755

    follow-redirects sensitiveHeaders regex escaping can expose credential headers

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whos…

    follow-redirects follow-redirects langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-111756

    follow-redirects array-form headers bypass cross-origin credential stripping

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-d…

    follow-redirects follow-redirects langfuse-3-worker prism Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-111755
  • report
    https://access.redhat.com/security/cve/CVE-2026-111756
  • report
    https://access.redhat.com/security/cve/CVE-2026-114125
  • report
    https://access.redhat.com/security/cve/CVE-2026-114126
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88478.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555733
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111755
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111755
  • article
    https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
  • article
    https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
  • article
    https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556370
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111756
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111756
  • article
    https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
  • article
    https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2558395
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-114125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-114125
  • article
    https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
  • article
    https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
  • article
    https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
  • article
    https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
  • article
    https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
  • article
    https://github.com/storybookjs/storybook/pull/36726
  • article
    https://github.com/storybookjs/storybook/releases/tag/v10.6.2
  • article
    https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
  • article
    https://github.com/storybookjs/storybook/releases/tag/v8.6.19
  • article
    https://github.com/storybookjs/storybook/releases/tag/v9.1.21
  • article
    https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2558414
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-114126
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-114126
  • article
    https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5
  • article
    https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
  • article
    https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77