CVE-2026-56764 is a timing attack vulnerability in the Hono project's authentication middleware (basicAuth and bearerAuth). The vulnerability arises from the use of non-constant-time string comparison, which enables an attacker to infer valid credentials by analyzing response timing differences. This vulnerability affects Red Hat Hardened Images RPMs, specifically grafana13.1 versions from 13.1.0 up to and including 13.1.1, and also versions from 12.4.0 through 12.4.6. Red Hat has issued a security advisory (RHSA-2026:47618) with updated RPM packages to fix this issue. The CVSS base score is 3.7 (low severity) according to Red Hat's assessment. No active exploitation has been reported.

The vulnerability allows remote attackers to perform timing attacks against authentication middleware, potentially revealing valid credentials. This can lead to unauthorized access to systems using the affected Red Hat Hardened Images RPMs. However, the impact is limited to confidentiality with no reported impact on integrity or availability. The severity is low, and no known exploits are currently in the wild.

Red Hat has released updated RPM packages for Red Hat Hardened Images, including grafana13.1-13.1.1-0.2.hum1 for aarch64 and x86_64 architectures, which address this timing attack vulnerability. Users should apply these updates following Red Hat's official guidance at https://images.redhat.com/. There are no indications that additional mitigations are required beyond applying the provided updates.