Skip to content
OpenAdvisories
High RHSA-2026:91292 10 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.13-0.5.hum1

Vulnerabilities 10

  • High 8.9
    CVE-2026-103506

    SSO settings authorization bypass

    An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu
  • High 7.5
    CVE-2026-100352

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote u…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100353

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote cl…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-100354

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document va…

    getkin kin-openapi kubevela-vela-core kubevela-vela-cli Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-111181

    body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding suc…

    body-parser body-parser langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.1
    CVE-2026-110306

    fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before val…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Medium 6.0
    CVE-2026-79656

    OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

    A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to it…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 4.8
    CVE-2026-110180

    fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the W…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-110095

    fast-uri vulnerable to improper path equivalence in relative reference normalization

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relat…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-110725

    fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-110095
  • report
    https://access.redhat.com/security/cve/CVE-2026-110180
  • report
    https://access.redhat.com/security/cve/CVE-2026-110306
  • report
    https://access.redhat.com/security/cve/CVE-2026-110725
  • report
    https://access.redhat.com/security/cve/CVE-2026-111181
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-103506
  • report
    https://access.redhat.com/security/cve/CVE-2026-79656
  • report
    https://access.redhat.com/security/cve/CVE-2026-100352
  • report
    https://access.redhat.com/security/cve/CVE-2026-100353
  • report
    https://access.redhat.com/security/cve/CVE-2026-100354
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91292.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528700
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-79656
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-79656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100352
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100352
  • article
    https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.148.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553592
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100353
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100353
  • article
    https://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9
  • article
    https://github.com/getkin/kin-openapi/releases/tag/v0.149.0
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553590
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-100354
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-100354
  • article
    https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff
  • article
    https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2554120
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-103506
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-103506
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556002
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-110095
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-110095