The vulnerability CVE-2026-73086 affects the nanoid JavaScript library by allowing an integer overflow in the nanoid(size) function. This overflow causes the random number generator to produce predictable outputs, resulting in identical identifiers for security-critical tokens such as session tokens, CSRF tokens, and API keys. The flaw can be exploited remotely without privileges or user interaction but requires specific input conditions. Red Hat has issued a security advisory (RHSA-2026:54412) updating Red Hat Hardened Images RPMs, including grafana13.1-13.1.3-0.1.hum1, to address this issue. The advisory notes no current mitigations meet Red Hat's criteria aside from applying the update. The vulnerability is classified under CWE-1241 (Use of Predictable Algorithm in Random Number Generator) and has a Red Hat CVSS v3 base score of 7.4 (Important severity).

Exploitation of this vulnerability allows an attacker to predict identifiers generated by the nanoid library, including session tokens, CSRF tokens, and API keys. This predictability can enable bypassing security controls that rely on the uniqueness and randomness of these tokens, potentially compromising confidentiality and integrity of affected systems. The vulnerability does not impact availability. The attack complexity is high and requires no privileges or user interaction.

Red Hat has released updated RPM packages for Red Hat Hardened Images, including grafana13.1-13.1.3-0.1.hum1, that fix this vulnerability. Applying these updates is the recommended remediation. Currently, no alternative mitigations meet Red Hat's criteria for ease of use, applicability, or stability. Users should follow Red Hat's official update instructions at https://images.redhat.com/ to apply the fix. Monitoring for updates from Red Hat is advised to ensure timely patching.