RHSA-2026:88478

Vulnerability from csaf_redhat - Published: 2026-10-23 01:10 - Updated: 2026-10-30 06:54
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: grafana12.4: * grafana12.4-12.4.13-0.3.hum1 (aarch64, x86_64) * grafana12.4-12.4.13-0.3.hum1.src (src) Security Fix(es): grafana12.4: * CVE-2026-114126 * CVE-2026-114125 * CVE-2026-111756 * CVE-2026-111755
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-111755

A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fails to properly escape them when building its header filtering logic. Consequently, the protection mechanism fails to strip the sensitive headers, forwarding sensitive authentication data to third-party redirect destinations.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64 —
Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src —
Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64 —
Vendor Fix fix
Threats
Impact Moderate
CVE-2026-111756

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redirect to capture authentication tokens and session cookies, leading to sensitive information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Affected products
Fixed 3 products, the same list as for CVE-2026-111755
Threats
Impact Important
CVE-2026-114125

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected interface, attacker-controlled events can reach the active preview and modify story files, resulting in code execution with the developer's privileges.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-346 - Origin Validation Error
Affected products
Fixed 3 products, the same list as for CVE-2026-111755
Threats
Impact Important
CVE-2026-114126

A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network (LAN). An attacker on the local network can capture this token and abuse file-writing functionality to inject malicious code into project files, executing commands with the developer's privileges.

8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-201 - Insertion of Sensitive Information Into Sent Data
Affected products
Fixed 3 products, the same list as for CVE-2026-111755
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:88478 self
https://access.redhat.com/security/cve/CVE-2026-111755 external
https://access.redhat.com/security/cve/CVE-2026-111756 external
https://access.redhat.com/security/cve/CVE-2026-114125 external
https://access.redhat.com/security/cve/CVE-2026-114126 external
https://access.redhat.com/security/updates/classi… external
https://images.redhat.com/ external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-111755 self
https://bugzilla.redhat.com/show_bug.cgi?id=2555733 external
https://www.cve.org/CVERecord?id=CVE-2026-111755 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111755 external
https://github.com/follow-redirects/follow-redire… external
https://github.com/follow-redirects/follow-redire… external
https://github.com/follow-redirects/follow-redire… external
https://access.redhat.com/security/cve/CVE-2026-111756 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556370 external
https://www.cve.org/CVERecord?id=CVE-2026-111756 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111756 external
https://github.com/follow-redirects/follow-redire… external
https://github.com/follow-redirects/follow-redire… external
https://access.redhat.com/security/cve/CVE-2026-114125 self
https://bugzilla.redhat.com/show_bug.cgi?id=2558395 external
https://www.cve.org/CVERecord?id=CVE-2026-114125 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114125 external
https://github.com/storybookjs/storybook/commit/2… external
https://github.com/storybookjs/storybook/commit/3… external
https://github.com/storybookjs/storybook/commit/9… external
https://github.com/storybookjs/storybook/commit/d… external
https://github.com/storybookjs/storybook/commit/d… external
https://github.com/storybookjs/storybook/pull/36726 external
https://github.com/storybookjs/storybook/releases… external
https://github.com/storybookjs/storybook/releases… external
https://github.com/storybookjs/storybook/releases… external
https://github.com/storybookjs/storybook/releases… external
https://github.com/storybookjs/storybook/security… external
https://access.redhat.com/security/cve/CVE-2026-114126 self
https://bugzilla.redhat.com/show_bug.cgi?id=2558414 external
https://www.cve.org/CVERecord?id=CVE-2026-114126 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114126 external
https://github.com/storybookjs/storybook/commit/5… external
https://github.com/storybookjs/storybook/commit/a… external
https://github.com/storybookjs/storybook/security… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.13-0.3.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.13-0.3.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n  * CVE-2026-114126\n  * CVE-2026-114125\n  * CVE-2026-111756\n  * CVE-2026-111755",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:88478",
        "url": "https://access.redhat.com/errata/RHSA-2026:88478"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111755",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111755"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-114125",
        "url": "https://access.redhat.com/security/cve/CVE-2026-114125"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-114126",
        "url": "https://access.redhat.com/security/cve/CVE-2026-114126"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88478.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-10-30T06:54:48+00:00",
      "generator": {
        "date": "2026-10-30T06:54:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:88478",
      "initial_release_date": "2026-10-23T01:10:24+00:00",
      "revision_history": [
        {
          "date": "2026-10-23T01:10:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-23T01:13:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T06:54:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.3.hum1@aarch64",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.3.hum1@aarch64",
                  "product_id": "grafana12.4-0:12.4.13-0.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.3.hum1@src",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.3.hum1@src",
                  "product_id": "grafana12.4-0:12.4.13-0.3.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12.4-0:12.4.13-0.3.hum1@x86_64",
                "product": {
                  "name": "grafana12.4-0:12.4.13-0.3.hum1@x86_64",
                  "product_id": "grafana12.4-0:12.4.13-0.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.13-0.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.3.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.3.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12.4-0:12.4.13-0.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
        },
        "product_reference": "grafana12.4-0:12.4.13-0.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-111755",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-10-19T17:41:46.313608+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2555733"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fails to properly escape them when building its header filtering logic. Consequently, the protection mechanism fails to strip the sensitive headers, forwarding sensitive authentication data to third-party redirect destinations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate severity rather than Important because exploitation requires a specific non-default application configuration and an external redirect to an untrusted host. Standard credentials and common authentication headers such as Cookie and Authorization are stripped properly during cross-origin redirection under default behavior. Exposure is limited to scenarios where an application specifically configures custom sensitive headers that contain uncommon token metacharacters and initiates requests to destinations capable of redirecting traffic to an attacker-controlled endpoint.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111755"
        },
        {
          "category": "external",
          "summary": "RHBZ#2555733",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555733"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111755",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111755"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111755",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111755"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8",
          "url": "https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1",
          "url": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c",
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"
        }
      ],
      "release_date": "2026-10-19T17:27:09.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T01:10:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88478"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering"
    },
    {
      "cve": "CVE-2026-111756",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-10-20T18:11:32.661165+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556370"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redirect to capture authentication tokens and session cookies, leading to sensitive information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as an Important severity impact because unauthenticated remote servers can harvest sensitive authorization credentials when following cross-origin redirects without requiring user interaction. Client applications utilizing this library to query untrusted endpoints while supplying headers in array structures inadvertently expose credentials across differing origins or insecure transport channels. The risk is constrained to scenarios where services perform outbound requests to external, untrusted hosts using this specific header format.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556370",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556370"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111756"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff",
          "url": "https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1",
          "url": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8",
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"
        }
      ],
      "release_date": "2026-10-20T17:58:21.005000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T01:10:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88478"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than alternating arrays when invoking follow-redirects: upgrade to follow-redirects 1.16.1 (or the fixed Prometheus/Grafana builds), which detect if options.headers is an array and convert alternating name-value pairs into a plain JavaScript object before sanitizing and stripping headers, closing all 2 injection vectors (cross-origin HTTP redirect, protocol downgrade redirect). Until patched, this is a concern on Applications on any platform issuing requests with array-formatted sensitive headers via follow-redirects, so Configure outgoing requests to pass headers strictly as plain objects instead of alternating arrays and avoid contacting untrusted endpoints capable of triggering cross-origin redirects. These controls limit blast radius and contain exploitation, but they do not fix the underlying array-formatted header stripping bypass defect \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects"
    },
    {
      "cve": "CVE-2026-114125",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-10-21T17:23:52.474735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558395"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected interface, attacker-controlled events can reach the active preview and modify story files, resulting in code execution with the developer\u0027s privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as Important because an attacker can achieve arbitrary code execution under the privileges of the local user by manipulating cross-origin preview messaging. Successful exploitation requires strict preconditions, specifically that a Storybook development instance is running locally while the developer is enticed to visit and navigate an untrusted web page. Red Hat products package frontend components as static production assets rather than running interactive development servers, substantially limiting real-world exposure across enterprise environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114125"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558395",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558395"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114125",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114125"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114125",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114125"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da",
          "url": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178",
          "url": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0",
          "url": "https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e",
          "url": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed",
          "url": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/pull/36726",
          "url": "https://github.com/storybookjs/storybook/pull/36726"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
          "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8"
        }
      ],
      "release_date": "2026-10-21T17:08:12.102000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T01:10:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88478"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions"
    },
    {
      "cve": "CVE-2026-114126",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-10-21T17:42:10.637321+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558414"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network (LAN). An attacker on the local network can capture this token and abuse file-writing functionality to inject malicious code into project files, executing commands with the developer\u0027s privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important rather than Moderate because an unauthenticated attacker on the same local network can achieve arbitrary code execution under the developer\u0027s privileges without requiring victim interaction. In Red Hat environments, Storybook is used as a development and build-time utility rather than an exposed runtime service in production deployments. Consequently, risk is confined to active development environments where the development server is reachable over the local network, whereas pre-built static artifacts and standard production runtimes remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
          "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114126"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558414",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558414"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114126",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114126"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114126",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114126"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da",
          "url": "https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178",
          "url": "https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5",
          "url": "https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb",
          "url": "https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e",
          "url": "https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed",
          "url": "https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/pull/36726",
          "url": "https://github.com/storybookjs/storybook/pull/36726"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21",
          "url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.21"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77",
          "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77"
        }
      ],
      "release_date": "2026-10-21T17:21:29.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T01:10:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88478"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@aarch64",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@src",
            "Red Hat Hardened Images:grafana12.4-0:12.4.13-0.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.