Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

This Red Hat security advisory addresses multiple vulnerabilities in the Red Hat Hardened Images RPMs for grafana12.4 and grafana13.1. The update includes RPM packages grafana12.4-12.4.9-0.4.hum1 and grafana13.1-13.1.3-0.2.hum1, which fix several CVEs including CVE-2026-73501, CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, and CVE-2026-76172. The vulnerabilities correspond to various CWEs such as CWE-306 (Missing Authentication for Critical Function), CWE-140 (Improper Input Validation), CWE-444 (Inconsistent Interpretation of HTTP Requests), CWE-918 (Server-Side Request Forgery), CWE-76 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), and CWE-770 (Allocation of Resources Without Limits or Throttling). The advisory is published and the updated packages are available from Red Hat's repositories.

The vulnerabilities fixed by this update are rated as high severity and affect the security posture of the grafana packages within Red Hat Hardened Images. These issues could potentially allow unauthorized actions, improper input handling, or resource exhaustion if exploited. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated RPM packages for grafana12.4 and grafana13.1 that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. The advisory provides links to the updated packages and instructions for applying the updates. No additional mitigation steps are indicated beyond applying the vendor-provided fixes.