{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.2:\n  * grafana13.2-13.2.5-0.1.hum1 (aarch64, s390x, x86_64)\n  * grafana13.2-13.2.5-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:99114",
        "url": "https://access.redhat.com/errata/RHSA-2026:99114"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-100105",
        "url": "https://access.redhat.com/security/cve/CVE-2026-100105"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88967",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88967"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-103506",
        "url": "https://access.redhat.com/security/cve/CVE-2026-103506"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-88858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-88858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111000",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111000"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-82014",
        "url": "https://access.redhat.com/security/cve/CVE-2026-82014"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106475",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106475"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-107365",
        "url": "https://access.redhat.com/security/cve/CVE-2026-107365"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-81843",
        "url": "https://access.redhat.com/security/cve/CVE-2026-81843"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99114.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-13T13:33:43+00:00",
      "generator": {
        "date": "2026-11-13T13:33:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:99114",
      "initial_release_date": "2026-11-11T18:36:13+00:00",
      "revision_history": [
        {
          "date": "2026-11-11T18:36:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-12T18:39:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T13:33:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.5-0.1.hum1@aarch64",
                "product": {
                  "name": "grafana13.2-0:13.2.5-0.1.hum1@aarch64",
                  "product_id": "grafana13.2-0:13.2.5-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.5-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.5-0.1.hum1@s390x",
                "product": {
                  "name": "grafana13.2-0:13.2.5-0.1.hum1@s390x",
                  "product_id": "grafana13.2-0:13.2.5-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.5-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.5-0.1.hum1@src",
                "product": {
                  "name": "grafana13.2-0:13.2.5-0.1.hum1@src",
                  "product_id": "grafana13.2-0:13.2.5-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.5-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.5-0.1.hum1@x86_64",
                "product": {
                  "name": "grafana13.2-0:13.2.5-0.1.hum1@x86_64",
                  "product_id": "grafana13.2-0:13.2.5-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.5-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.5-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64"
        },
        "product_reference": "grafana13.2-0:13.2.5-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.5-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x"
        },
        "product_reference": "grafana13.2-0:13.2.5-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.5-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src"
        },
        "product_reference": "grafana13.2-0:13.2.5-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.5-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        },
        "product_reference": "grafana13.2-0:13.2.5-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-88858",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2554121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user, including one with basic viewer privileges, can cause a Denial of Service (DoS) by submitting deeply nested mathematical expressions that crash the server. Additionally, an authorized user can incorporate such expressions into alert rules, causing the service crash to repeat continuously across restarts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Math expressions could crash Grafana",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate per upstream Grafana Labs (CVSS 6.5). An authenticated user with Viewer privileges can crash the Grafana server by submitting a crafted server-side math expression that triggers uncontrolled recursion. A user who can provision alert rules can make the outage persist across restarts. Confidentiality and integrity are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2554121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88858"
        }
      ],
      "release_date": "2026-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "Disable server-side expressions in the Grafana configuration:\n\n1. Edit `/etc/grafana/grafana.ini` and set the following configuration under the `[expressions]` block:\n```ini\n[expressions]\nenabled = false\n```\n\n2. Restart the Grafana service:\n```bash\nsystemctl restart grafana-server\n```\n\nCaveats:\nDisabling expressions completely disables server-side math expressions as well as all expression-based alert rules.\n\nWarning: Restarting the `grafana-server` service will cause a temporary interruption of service for active sessions.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Math expressions could crash Grafana"
    },
    {
      "cve": "CVE-2026-88967",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2554113"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. This information disclosure vulnerability allows an authenticated user with permission to query an Azure Monitor data source, including a user with the Viewer role, to cause Grafana to send the data source\u0027s Azure access token to an arbitrary destination. An attacker could exploit this flaw to intercept sensitive credentials and gain unauthorized access to the associated cloud resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Azure Monitor data source could leak its Azure access token",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because low-privileged authenticated users can exfiltrate sensitive cloud credentials, potentially granting unauthorized access to external infrastructure. In environments where Grafana integrates with Azure Monitor, users with Viewer permissions can induce the service to transmit authentication tokens to an arbitrary external server. Deployments that do not configure Azure Monitor data sources or do not expose query capabilities to untrusted accounts are not susceptible to this risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-88967"
        },
        {
          "category": "external",
          "summary": "RHBZ#2554113",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554113"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-88967",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-88967"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-88967",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88967"
        }
      ],
      "release_date": "2026-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "Restrict query permissions on configured Azure Monitor data sources exclusively to trusted users, or remove the data source configuration entirely if it is not in active use.\n\n1. Within the Grafana administration interface, open the Azure Monitor data source settings and adjust permissions to limit query access only to trusted administrative roles.\n2. If Azure Monitor is no longer needed, remove the data source configuration from Grafana.\n3. At the cloud provider level, reduce permissions assigned to the Azure identity or service principal used by Grafana to enforce the principle of least privilege.\n\nCaveats: Restricting query access or deleting the data source will prevent non-administrative users from viewing dashboards, panels, or alerts that rely on Azure Monitor metrics.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: Azure Monitor data source could leak its Azure access token"
    },
    {
      "cve": "CVE-2026-100105",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-10-28T17:18:09.553388+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2563003"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with permission to edit alert contact points can bypass field-level authorization restrictions by switching an integration to a legacy schema version. This flaw allows the user to alter protected settings such as destination URLs, potentially leading to information disclosure through exposed credentials and the redirection of alert notifications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Information disclosure via legacy schema switch in contact points",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because an authenticated account granted low-privilege editing rights can cross authorization boundaries to exfiltrate sensitive secrets and manipulate alerting endpoints. In typical Red Hat environments, Grafana instances manage notification channels containing embedded authentication tokens and webhook targets for monitoring infrastructure. While standard users lacking alerting privileges cannot trigger this issue, any identity permitted to manage notification channels can circumvent field-level protections through legacy configuration formats, risking the compromise of external service credentials.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100105"
        },
        {
          "category": "external",
          "summary": "RHBZ#2563003",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100105",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100105"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100105",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100105"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-100105",
          "url": "https://grafana.com/security/security-advisories/cve-2026-100105"
        }
      ],
      "release_date": "2026-10-28T16:48:58.880000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "Limit Grafana alerting contact-point create/edit permissions to trusted administrators only. Restrict access to the Grafana management UI and Alerting APIs to trusted networks; rotate contact-point secrets if unauthorized edits are suspected.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: Grafana: Information disclosure via legacy schema switch in contact points"
    },
    {
      "cve": "CVE-2026-103506",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2554120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this vulnerability to view sensitive SSO client secrets and modify authentication settings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important impact because authenticated users possessing minimal viewer privileges can expose sensitive single sign-on credentials and modify authentication configurations across the platform. Such credential exposure may allow attackers to compromise downstream identity providers or escalate access within the organization. However, the risk is constrained in standard Red Hat environments because the affected API relies on an experimental feature toggle that remains deactivated by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-103506"
        },
        {
          "category": "external",
          "summary": "RHBZ#2554120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-103506",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103506"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103506",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103506"
        }
      ],
      "release_date": "2026-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "Ensure the experimental `kubernetesSsoSettingsApi` feature toggle is disabled. By default, this feature toggle is inactive. If this feature was manually activated, remove `kubernetesSsoSettingsApi` from the `[feature_toggles]` section in the Grafana configuration file (`grafana.ini`) or from the `GF_FEATURE_TOGGLES_ENABLE` environment variable.\n\nApply the configuration by restarting the service:\n```\nsystemctl restart grafana-server\n```\n\nWarning: Restarting the `grafana-server` service will result in a temporary interruption of service for connected users. Additionally, if the toggle was previously enabled, immediately rotate all associated SSO client secrets to prevent unauthorized access from potentially exposed credentials.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled"
    },
    {
      "cve": "CVE-2026-106475",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "discovery_date": "2026-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2565159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana\u0027s Elasticsearch data source. An authenticated user with permission to query the data source, such as a viewer, can send arbitrary requests to the connected Elasticsearch cluster using the data source\u0027s stored credentials. This allows an attacker to bypass intended restrictions, access data across unauthorized indices, and execute write operations to modify index configurations or data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: ELASTICSEARCH DATA SOURCE COULD BE USED TO SEND ARBITRARY REQUESTS TO ELASTICSEARCH",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as an Important severity flaw because low-privileged authenticated users, including those with Viewer permissions, can use configured Elasticsearch data sources to dispatch arbitrary requests to the backend cluster using the data source credentials. This exposure can allow attackers to perform write operations, modify index mappings, or access data in indices beyond what the data source was intended to query. The risk is constrained to Grafana deployments where an Elasticsearch data source has been established and requires valid user credentials to interact with the service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106475"
        },
        {
          "category": "external",
          "summary": "RHBZ#2565159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106475",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106475"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106475",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106475"
        }
      ],
      "release_date": "2026-11-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "Restrict the permissions granted to the credentials used by Grafana to connect to Elasticsearch:\n\n1. Configure Elasticsearch role-based access control to assign the data source account a strictly read-only role constrained to the specific indices required for monitoring.\n2. Ensure that write privileges, index creation or management permissions, and cluster-level administrative rights are removed from the configured data source credentials.\n\nCaveats:\nApplying strict read-only access may disrupt workflows if existing dashboards or integrations expect the data source to write data or query unassigned indices. Grafana does not require a service restart for modified Elasticsearch role permissions to take effect, but changes apply immediately on the Elasticsearch backend.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: ELASTICSEARCH DATA SOURCE COULD BE USED TO SEND ARBITRARY REQUESTS TO ELASTICSEARCH"
    },
    {
      "cve": "CVE-2026-107365",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery"
      },
      "discovery_date": "2026-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2565163"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with query permissions can redirect Google Cloud Monitoring data source requests to unauthorized API endpoints. This issue can lead to information disclosure by exposing sensitive data across accessible cloud projects, and may allow unauthorized modifications depending on the permissions of the configured credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate because exploitation requires an authenticated user with permissions to query a configured Google Cloud Monitoring data source, preventing unauthenticated remote abuse. In Red Hat environments, Grafana is not configured with Google Cloud Monitoring integrations by default. The exposure is further constrained by the specific permissions assigned to the underlying data source credentials in Google Cloud.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-107365"
        },
        {
          "category": "external",
          "summary": "RHBZ#2565163",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565163"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-107365",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107365"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107365",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107365"
        }
      ],
      "release_date": "2026-11-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T18:36:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99114"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, enforce least-privilege access controls and disable credential forwarding on the Google Cloud Monitoring data source:\n\n1. Configure the data source with service account credentials restricted strictly to read-only Cloud Monitoring roles on explicitly designated Google Cloud projects.\n2. Ensure that \"Forward OAuth Identity\" and \"Workload Identity Federation\" settings are disabled on the affected data source.\n3. If Google Cloud Monitoring is not required, remove the data source from Grafana or restrict data source query permissions to administrative users.\n\nWarning: If data sources are provisioned via configuration files on the host, applying changes may require restarting the service (`systemctl restart grafana-server`), which will cause a brief interruption of service. Restricting credentials will prevent users from accessing metrics outside designated projects.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@s390x",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.5-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: GOOGLE CLOUD MONITORING DATA SOURCE COULD REACH OTHER CLOUD MONITORING API PATHS"
    }
  ]
}