Threats Tagged 'cve-2026-84303'

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Red Hat has issued a security advisory addressing multiple vulnerabilities, including the high-severity CVE-2026-41178, affecting Red Hat Advanced Cluster Management for Kubernetes and related products such as the Migration Toolkit for Applications and Red Hat Trusted Artifact Signer. These vulnerabilities impact various versions of Red Hat's Kubernetes management and application migration components. A patch is available to remediate these issues.

rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fix(es): * golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This security update for the hauler component addresses multiple vulnerabilities including authentication bypass and deadlocks in the golang.org/x/crypto/ssh library, as well as denial of service (DoS) issues in google.golang.org/grpc caused by missing ':authority' and 'Host' headers. The update advances hauler to version 2.1.0 and fixes several CVEs (CVE-2026-41888, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445). The vulnerabilities are rated critical and a patch is available. No known exploits in the wild have been reported.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-84303 is a medium severity vulnerability in grpc-go prior to version 1.83.1. It involves improper handling of case sensitivity in the xDS RBAC HTTP filter, causing header matcher names not to be lowercased as expected. This leads to DENY policies with mixed-case header names failing to match and thus failing open, allowing unauthorized requests. Additionally, certain headers like :Scheme, Grpc-Status, and Host are improperly handled, affecting validation and rewriting. The issue is fixed in grpc-go version 1.83.1.

grpc-gateway version 2.28.0 contains an incorrect access control vulnerability involving the processing of the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not properly restrict allowed HTTP methods, which can lead to unintended method overrides when handling POST requests with Content-Type application/x-www-form-urlencoded. This vulnerability is assigned CVE-2026-37236 and is rated medium severity. No patch or CVSS score is currently available, and no known exploits have been reported in the wild.

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

grpc-gateway version 2.28.0 has an incorrect access control vulnerability where the X-HTTP-Method-Override header is processed without restricting allowed HTTP methods. This allows an attacker to rewrite the HTTP method of a POST request with content type application/x-www-form-urlencoded to an arbitrary method before routing, potentially bypassing method-based access controls enforced by upstream proxies or WAFs.

This security update for the Trivy tool addresses multiple vulnerabilities across several dependencies, including improper certificate validation, HTTP method override bypass, denial of service via oversized inputs, information disclosure through crafted tarball hardlinks, authentication bypass and deadlocks in SSH libraries, authorization bypass due to header case mismatches, heap memory exhaustion, and denial of service from missing headers in gRPC servers. These issues collectively pose risks ranging from low to potentially higher impact depending on context. The update fixes these issues to improve overall security.