{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.2:\n  * grafana13.2-13.2.4-0.1.hum1 (aarch64, s390x, x86_64)\n  * grafana13.2-13.2.4-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85544",
        "url": "https://access.redhat.com/errata/RHSA-2026:85544"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15577",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15577"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33374",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33374"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-95502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-95502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93294",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93294"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111757",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111757"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92539",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92539"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85544.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-07T05:54:17+00:00",
      "generator": {
        "date": "2026-11-07T05:54:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:85544",
      "initial_release_date": "2026-10-19T21:42:26+00:00",
      "revision_history": [
        {
          "date": "2026-10-19T21:42:26+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-20T22:07:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:54:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.1.hum1@aarch64",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.1.hum1@aarch64",
                  "product_id": "grafana13.2-0:13.2.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.1.hum1@s390x",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.1.hum1@s390x",
                  "product_id": "grafana13.2-0:13.2.4-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.1.hum1@src",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.1.hum1@src",
                  "product_id": "grafana13.2-0:13.2.4-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.4-0.1.hum1@x86_64",
                "product": {
                  "name": "grafana13.2-0:13.2.4-0.1.hum1@x86_64",
                  "product_id": "grafana13.2-0:13.2.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        },
        "product_reference": "grafana13.2-0:13.2.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15577",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request"
      },
      "discovery_date": "2026-10-13T17:23:50.330280+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550704"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite lacking administrative or write permissions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Unauthorized configuration modification via status subresource",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. An authenticated user or service account that only has read access to Git Sync (provisioning) connections can change a connection\u0027s configuration through the status subresource because of incorrect authorization. Impact is integrity of Git Sync configuration only; confidentiality and availability are not affected. On Grafana 12.4 the vulnerable API is available only when the experimental provisioning feature toggle is enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15577"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550704",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550704"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15577"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-15577",
          "url": "https://grafana.com/security/security-advisories/cve-2026-15577"
        }
      ],
      "release_date": "2026-10-13T17:05:49.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        },
        {
          "category": "workaround",
          "details": "If Git Sync / experimental provisioning is not required, disable it so the vulnerable status API is not exposed. Restrict Grafana network access to trusted administrators. Minimize identities granted even read access to Git Sync connections and audit connection settings after suspicious activity.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Unauthorized configuration modification via status subresource"
    },
    {
      "cve": "CVE-2026-33374",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-13T17:22:32.715658+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550703"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. An authenticated Grafana user who can call the Prometheus rule conversion API can submit an oversized request body that triggers unbounded memory allocation and can crash the Grafana process (denial of service). There is no confidentiality or integrity impact from this flaw. Exploitation requires a valid account with access to the conversion API, and the availability impact is limited to the Grafana service itself.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550703",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550703"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33374"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-33374",
          "url": "https://grafana.com/security/security-advisories/cve-2026-33374"
        }
      ],
      "release_date": "2026-10-13T17:05:49.782000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        },
        {
          "category": "workaround",
          "details": "Restrict access to the Grafana UI and HTTP API to trusted clients and administrative networks. Limit accounts that can authenticate to Grafana and review roles that can use alerting or Prometheus rule conversion APIs. Apply process or cgroup memory limits to reduce out-of-memory blast radius.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API"
    },
    {
      "cve": "CVE-2026-92539",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "discovery_date": "2026-10-20T18:37:23.977757+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556381"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Unauthorized cross-organization user management via the SCIM API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. On Grafana Enterprise with SCIM enabled, a service account with user-management rights in one organization can read, modify, disable, or delete users in other organizations through the SCIM API, breaking tenant isolation. Confidentiality impact is limited; integrity and availability of user accounts can be high within the instance. Red Hat products ship Grafana OSS and do not include Grafana Enterprise SCIM, so Red Hat product builds are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556381",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556381"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92539",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-92539",
          "url": "https://grafana.com/security/security-advisories/cve-2026-92539"
        }
      ],
      "release_date": "2026-10-20T16:55:17.875000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        },
        {
          "category": "workaround",
          "details": "Not applicable to Red Hat product builds, which do not ship Grafana Enterprise SCIM. If you run upstream Grafana Enterprise with SCIM, restrict SCIM and user-management credentials to highly trusted service accounts, isolate the Grafana management plane. Prefer separate Grafana instances per tenant when strong isolation is required.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Unauthorized cross-organization user management via the SCIM API"
    },
    {
      "cve": "CVE-2026-93294",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery"
      },
      "discovery_date": "2026-10-13T17:29:57.133118+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550715"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with query access to an Azure Monitor data source can misuse its resource proxy to send unauthorized requests to Azure Resource Manager Application Programming Interfaces (APIs) using the data source\u0027s configured cloud identity. This unintended proxying can lead to information disclosure, allowing an attacker to access sensitive cloud resources within the scope of the identity\u0027s permissions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Information disclosure via Azure Monitor resource proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate information disclosure flaw was found in Grafana, affecting the grafana component as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat Ceph Storage, Red Hat Advanced Cluster Management for Kubernetes, Multicluster Global Hub, and Red Hat In-Vehicle OS, as well as Red Hat Hardened Images and Fedora community builds. An authenticated Grafana user with query access to an Azure Monitor data source can misuse its resource proxy to send requests to Azure Resource Manager APIs beyond those Grafana requires, using the data source\u0027s configured cloud identity. This unintended proxying allows an attacker to read sensitive Azure cloud resources within the scope of that identity\u0027s permissions, with no impact on integrity or availability. Some RHEL 8 grafana streams are not affected because the vulnerable code is not present. Red Hat rates this flaw 4.3 (Moderate) rather than the upstream 6.3 because the disclosure is bounded by the Azure role granted to the data source identity, resulting in low confidentiality impact with unchanged scope rather than the high confidentiality impact across a changed scope assessed upstream. For the affected Red Hat products the fix is deferred to a future update given the moderate impact and the authentication and query-access prerequisites; the residual risk is that an authenticated user could retrieve Azure resources accessible to the data source identity. For Red Hat Hardened Images and Fedora, a fix is being pursued through those channels.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550715",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550715"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-93294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93294"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-93294",
          "url": "https://grafana.com/security/security-advisories/cve-2026-93294"
        }
      ],
      "release_date": "2026-10-13T17:05:49.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Information disclosure via Azure Monitor resource proxy"
    },
    {
      "cve": "CVE-2026-95502",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-13T17:26:33.911607+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service (DoS) condition on the Grafana instance. Exploitation requires an administrator to have configured Git Sync to communicate with the untrusted server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Denial of Service via oversized Git Sync responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. If an administrator configures Grafana Git Sync against a malicious or compromised Git server, oversized or highly compressed responses can exhaust Grafana memory and cause a denial of service. Confidentiality and integrity are not affected. Exploitation depends on administrator-configured Git Sync to an untrusted server, which limits practical exposure. Upstream affects Grafana 13.0.x before 13.0.11, 13.1.x before 13.1.8, and 13.2.x before 13.2.4; Red Hat streams shipping Grafana 12.x or earlier are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-95502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-95502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-95502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-95502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95502"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-95502",
          "url": "https://grafana.com/security/security-advisories/cve-2026-95502"
        }
      ],
      "release_date": "2026-10-13T17:05:49.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        },
        {
          "category": "workaround",
          "details": "Do not point Git Sync at untrusted Git servers; use only trusted repositories and credentials. Restrict who can configure Git Sync and limit Grafana management-plane network exposure. Apply process or cgroup memory limits to contain memory-exhaustion impact.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Denial of Service via oversized Git Sync responses"
    },
    {
      "cve": "CVE-2026-111757",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-10-19T17:42:29.291567+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555734"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Hono\u0027s serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time before performing filesystem lookups, a specially crafted request with malformed percent encoding can bypass upstream security middleware. As a result, an attacker can access protected static files within the configured document root.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because unauthorized file retrieval is strictly bounded to the designated static asset directory and cannot be leveraged for arbitrary file system traversal. The issue only manifests in deployments where route-filtering or authentication handlers are layered in front of static file directories to restrict access to specific subpaths. Environments serving exclusively public content or managing authorization outside of route prefix middleware are unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555734",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555734"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111757"
        },
        {
          "category": "external",
          "summary": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc",
          "url": "https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc"
        },
        {
          "category": "external",
          "summary": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7",
          "url": "https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"
        }
      ],
      "release_date": "2026-10-19T17:31:20.341000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T21:42:26+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85544"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic"
    }
  ]
}