CVE-2026-18446VulnerabilityPublished 1 Aug 2026Updated 29 Oct 2026

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Affects Red HatSource GCVE Database

Compare

Not known to be exploited.

Data as of 29 Oct 2026, 07:15 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

A security update fixing this vulnerability is available in Red Hat Hardened Images RPMs, specifically grafana13.1-13.1.1-0.4.hum1 for aarch64 and x86_64. Users should apply this update to remediate the issue. Currently, no other mitigations meet Red Hat's criteria for effectiveness and ease of deployment. Therefore, applying the official update is the recommended course of action.

Description

CVE-2026-18446 is a host confusion vulnerability in the fast-uri library used by Red Hat Hardened Images RPMs. The flaw arises because fast-uri incorrectly parses URIs when a backslash is used instead of a forward slash to introduce the authority component, differing from Node.js's native URL parser. This discrepancy can allow remote attackers to bypass host-based security policies such as allowlists or SSRF filters, potentially redirecting applications to unintended hosts. Red Hat has released updated RPM packages for grafana13.1 containing the fix. No mitigation other than applying the update is currently recommended.

Impact

This vulnerability allows remote attackers to bypass host-based security policies such as allowlists or SSRF filters by exploiting the URI parsing discrepancy in fast-uri. This can lead to applications being redirected to arbitrary external hosts, potentially compromising the integrity of security controls. The impact is rated as high by Red Hat due to the potential for security policy bypass and redirection to unintended hosts.

CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
OWASP Cheat Sheets
Mass Assignment (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
OWASP ASVS 4.0.3
V5.1.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2026, 07:12 UTC

WeaknessesCWE-1289, CWE-915

Technical details

References

Community reviews

Related threats