Vulnerability-Lookup

RHSA-2026:85295

Vulnerability from csaf_redhat - Published: 2026-10-19 19:47 - Updated: 2026-11-07 05:54

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: grafana12.4: * grafana12.4-12.4.13-0.1.hum1 (aarch64, x86_64) * grafana12.4-12.4.13-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-92539

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation.

6.7 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

CWE-639 - Authorization Bypass Through User-Controlled Key

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-93294

A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source's configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity's permissions.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-918 - Server-Side Request Forgery

Affected products

Fixed 3 products, the same list as for CVE-2026-92539

Threats

Impact Moderate

CVE-2026-111757

A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted request with malformed percent encoding can bypass upstream security middleware. As a result, an attacker can access protected static files within the configured document root.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 3 products, the same list as for CVE-2026-92539

Threats

Impact Moderate

References

23 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:85295	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-93294	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-111757	external
https://access.redhat.com/security/cve/CVE-2026-92539	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-92539	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556381	external
https://www.cve.org/CVERecord?id=CVE-2026-92539	external
https://nvd.nist.gov/vuln/detail/CVE-2026-92539	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-93294	self
https://bugzilla.redhat.com/show_bug.cgi?id=2550715	external
https://www.cve.org/CVERecord?id=CVE-2026-93294	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93294	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-111757	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555734	external
https://www.cve.org/CVERecord?id=CVE-2026-111757	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111757	external
https://github.com/honojs/hono/commit/8b05c774ef1…	external
https://github.com/honojs/hono/security/advisorie…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.13-0.1.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.13-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85295",
        "url": "https://access.redhat.com/errata/RHSA-2026:85295"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93294",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93294"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111757",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111757"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92539",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92539"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85295.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-07T05:54:19+00:00",
      "generator": {
        "date": "2026-11-07T05:54:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:85295",
      "initial_release_date": "2026-10-19T19:47:23+00:00",
      "revision_history": [
        {
          "date": "2026-10-19T19:47:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-20T22:08:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:54:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.1.hum1@aarch64",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.1.hum1@aarch64",
                  "product_id": "grafana12.4-0:12.4.13-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.1.hum1@src",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.1.hum1@src",
                  "product_id": "grafana12.4-0:12.4.13-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.1.hum1@x86_64",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.1.hum1@x86_64",
                  "product_id": "grafana12.4-0:12.4.13-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-92539",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "discovery_date": "2026-10-20T18:37:23.977757+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556381"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Unauthorized cross-organization user management via the SCIM API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. On Grafana Enterprise with SCIM enabled, a service account with user-management rights in one organization can read, modify, disable, or delete users in other organizations through the SCIM API, breaking tenant isolation. Confidentiality impact is limited; integrity and availability of user accounts can be high within the instance. Red Hat products ship Grafana OSS and do not include Grafana Enterprise SCIM, so Red Hat product builds are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556381",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556381"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92539",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-92539",
          "url": "https://grafana.com/security/security-advisories/cve-2026-92539"
        }
      ],
      "release_date": "2026-10-20T16:55:17.875000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T19:47:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85295"
        },
        {
          "category": "workaround",
          "details": "Not applicable to Red Hat product builds, which do not ship Grafana Enterprise SCIM. If you run upstream Grafana Enterprise with SCIM, restrict SCIM and user-management credentials to highly trusted service accounts, isolate the Grafana management plane. Prefer separate Grafana instances per tenant when strong isolation is required.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Unauthorized cross-organization user management via the SCIM API"
    },
    {
      "cve": "CVE-2026-93294",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery"
      },
      "discovery_date": "2026-10-13T17:29:57.133118+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source\u0027s configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity\u0027s permissions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Information disclosure via Azure Monitor resource proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate information disclosure flaw was found in Grafana, affecting the grafana component as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, Multicluster Global Hub, and Red Hat In-Vehicle OS, as well as Red Hat Hardened Images and Fedora community builds. An authenticated Grafana user with query access to an Azure Monitor data source can misuse its resource proxy to send requests to Azure Resource Manager APIs beyond those Grafana requires, using the data source\u0027s configured cloud identity. This unintended proxying allows an attacker to read sensitive Azure cloud resources within the scope of that identity\u0027s permissions, with no impact on integrity or availability. Some RHEL 8 grafana streams are not affected because the vulnerable code is not present. Red Hat rates this flaw 4.3 (Moderate) rather than the upstream 6.3 because the disclosure is bounded by the Azure role granted to the data source identity, resulting in low confidentiality impact with unchanged scope rather than the high confidentiality impact across a changed scope assessed upstream. For the affected Red Hat products the fix is deferred to a future update given the moderate impact and the authentication and query-access prerequisites; the residual risk is that an authenticated user could retrieve Azure resources accessible to the data source identity. For Red Hat Hardened Images and Fedora, a fix is being pursued through those channels.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-93294",
          "url": "https://grafana.com/security/security-advisories/cve-2026-93294"
        }
      ],
      "release_date": "2026-10-13T17:05:49.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T19:47:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85295"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Information disclosure via Azure Monitor resource proxy"
    },
    {
      "cve": "CVE-2026-111757",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-10-19T17:42:29.291567+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555734"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hono\u0027s serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted request with malformed percent encoding can bypass upstream security middleware. As a result, an attacker can access protected static files within the configured document root.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because unauthorized file retrieval is strictly bounded to the designated static asset directory and cannot be leveraged for arbitrary file system traversal. The issue only manifests in deployments where route-filtering or authentication handlers are layered in front of static file directories to restrict access to specific subpaths. Environments serving exclusively public content or managing authorization outside of route prefix middleware are unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555734",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555734"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc",
          "url": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc"
        },
        {
          "category": "external",
          "summary": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7",
          "url": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"
        }
      ],
      "release_date": "2026-10-19T17:31:20.341000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T19:47:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85295"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic"
    }
  ]
}

CVE-2026-111757 (GCVE-0-2026-111757)

Vulnerability from cvelistv5 – Published: 2026-10-19 17:31 – Updated: 2026-10-20 16:10

Title

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 15:18 UTC

CWE

CWE-174 - Double Decoding of the Same Data

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/honojs/hono/security/advisorie…	x_refsource_CONFIRM
https://github.com/honojs/hono/commit/8b05c774ef1…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
honojs	hono	Affected: >= 4.12.4, < 4.13.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T15:18:52.675084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:10:30.638Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hono",
          "vendor": "honojs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.12.4, \u003c 4.13.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-174",
              "description": "CWE-174: Double Decoding of the Same Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T17:31:20.341Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"
        },
        {
          "name": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"
        },
        {
          "name": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc"
        }
      ],
      "source": {
        "advisory": "GHSA-5r4p-p66f-jhc7",
        "discovery": "UNKNOWN"
      },
      "title": "Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111757",
    "datePublished": "2026-10-19T17:31:20.341Z",
    "dateReserved": "2026-10-16T17:52:09.081Z",
    "dateUpdated": "2026-10-20T16:10:30.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92539 (GCVE-0-2026-92539)

Vulnerability from cvelistv5 – Published: 2026-10-20 16:55 – Updated: 2026-10-20 18:08

Title

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Summary

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 17:22 UTC

CWE

Assigner

GRAFANA CNA under the mitre root

CNA scorecard C 73/100 over 59 records in the last 180 days details

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver)

Date Public

2026-10-13 10:21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:22:31.577037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T18:08:00.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.3.11",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.13",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.11",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.8",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.2.4",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-10-13T10:21:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1220",
              "description": "CWE-1220",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T16:55:17.875Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-92539"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-92539",
    "datePublished": "2026-10-20T16:55:17.875Z",
    "dateReserved": "2026-09-16T12:55:31.889Z",
    "dateUpdated": "2026-10-20T18:08:00.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93294 (GCVE-0-2026-93294)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31

Title

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Summary

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 17:26 UTC

CWE

Assigner

GRAFANA CNA under the mitre root

CNA scorecard C 73/100 over 59 records in the last 180 days details

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 8.1.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver)
Grafana	Grafana OSS	Affected: 8.1.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver)

Date Public

2026-10-13 11:41

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93294",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T17:26:28.085923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:31:30.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.3.11",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.13",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.11",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.8",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.2.4",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.3.11",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.13",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.11",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.8",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.2.4",
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-10-13T11:41:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source\u0027s Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1220",
              "description": "CWE-1220",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:05:49.715Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-93294"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-93294",
    "datePublished": "2026-10-13T17:05:49.715Z",
    "dateReserved": "2026-09-17T16:21:17.776Z",
    "dateUpdated": "2026-10-13T19:31:30.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:85295

CVE-2026-111757 (GCVE-0-2026-111757)

CVE-2026-92539 (GCVE-0-2026-92539)

CVE-2026-93294 (GCVE-0-2026-93294)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour