Threats Tagged 'cve-2026-8595'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.1 package to version 13.1.3-0.5.hum1. This update addresses multiple security vulnerabilities identified by several CVEs including CVE-2026-8595. The advisory covers both aarch64 and x86_64 architectures. The update is a bug fix and enhancement release.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including an update to the grafana13.2 package (version 13.2.1-0.1.hum1) for aarch64 and x86_64 architectures. This update addresses multiple security vulnerabilities identified by several CVEs. The advisory provides updated RPMs to fix these issues and enhance security. No specific exploit details or active exploitation in the wild have been reported. The update is available and should be applied to affected systems.

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

This security update for Grafana addresses two vulnerabilities: CVE-2026-33382, which limits the size of the request body at several API endpoints to prevent potential issues, and CVE-2026-8595, which fixes a stored cross-site scripting (XSS) vulnerability in the table panel. Both vulnerabilities have been fixed in this update.

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).