VDB
RHSA-2026:55810
RHSA-2026:55810
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.
Risk Scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:53ab458b15b639a3fa185a26995817d05c2379d9757b370a6cf078c9b5519fe8_ppc64le as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aac78bba7d135fa6848e46238033c77f7353a24c5ea4cea59ae5f9b6663ef2d7_s390x as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:00387b28fb61aba5e23599be853aa3d1ca2ac60c61210ebab3b143b6240654b8_amd64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:44398c0c69a843b38209fa0f34264396e7985fd47a802329c04ccc98c1855130_arm64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6595a7acc86d1c40254cca9ca11cfee1c132c3c95151c4c0f850a76883628a3e_arm64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5f0bf5ac15dc9b542eebb9d0bba9e5f764a8ea772d6dd096f219458786fcaade_ppc64le as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7c20f24f0cd291831d8857c087fd5332ce0f72e365faece2db881517f594f9d5_amd64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f65ef27e2fc9146b99e248c57a9dbe4232201c4640733012f1116ff5686b6d2a_ppc64le as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:6c28ae3f509e4b42d61be90decb14af658bf114bcb6e429d862b7580fa577483_s390x as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2166fa9885345c3be7c43fa459b1606f61ac9f35cc53abb65dd8fd5e6b4b93de_arm64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:13cf42dcaa7e81a55d0ec079e7c30dc94f170b5c2afc25563c9e76ba194b3e66_s390x as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dc6852b0a21fc18cc69c3a05b4a59af12a29435972f82ffd68dc8b684ea96241_ppc64le as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9e15fced05d8b4301a11cbddb4e7a04b92db52badf4459771d0ce83ec195dea_arm64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:801d982bac8568fbe1a8655a334cffb812752b1e1677f5e6615137a5c1b60df3_ppc64le as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:74cb04ff8483d2c80705f7fda65481389256a51ba0f27809e772854060dc41a4_amd64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:792974503a47cc45b138cf96c4dfc68a4e223053b4a2d66f04e346d1d302cd20_arm64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:24425ecd3298355d2dacd8916076a53effc47d75c5ad4eaad3315e81676bc6ab_amd64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7b10f2f08780249626214d5fa10f700972d2f27ab8d8c59cc48675f7b17f798f_amd64 as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f29739944614d96575fb1a9e2df3a11fa7bf9fe861b555d6d9092d6eea8f2565_s390x as a component of Multicluster Global Hub 1.4.9 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5437ebf7e21bedbab79890bdbeba005cc08558e2015ed69868f0297de88b0a36_s390x as a component of Multicluster Global Hub 1.4.9 | * |
…and 1 more
Timeline
- Aug 17, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:55810 advisory
- https://access.redhat.com/security/cve/CVE-2026-33376 advisory
- https://access.redhat.com/security/cve/CVE-2026-33377 advisory
- https://access.redhat.com/security/cve/CVE-2026-42306 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-66801 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55810.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477262 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33376 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33376 advisory
- https://grafana.com/security/security-advisories/cve-2026-33376 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477246 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33377 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33377 advisory
- https://grafana.com/security/security-advisories/cve-2026-33377 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488484 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42306 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42306 advisory
- https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh advisory
…and 9 more