Snapshot 216744
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Kloudfuse Kloudfuse 4.4 Home main Kloudfuse Kloudfuse 4.4 Kloudfuse 4.3 Kloudfuse 4.2 Kloudfuse 4.1 Kloudfuse 4.0 Kloudfuse 3.5 Security Advisories Table of Contents About This Page Release 4.4.0 Fixed CVEs (54 total — 3 Critical, 51 High) Outstanding CVEs (High / Critical) Release 4.3.0 Fixed CVEs (28 total — 4 Critical, 24 High) Outstanding CVEs (High / Critical) This page lists Common Vulnerabilities and Exposures (CVEs) addressed in each Kloudfuse release, together with any HIGH or CRITICAL CVEs that remain unresolved pending upstream fixes. All Kloudfuse service images are scanned with Trivy and AWS Inspector after each release. For release-by-release feature and fix details, see also Release Notes. About This Page Rows are sorted CRITICAL → HIGH → MEDIUM → LOW within each table. CVE IDs link to the National Vulnerability Database, the Red Hat Security Advisory, or a GitHub Security Advisory. Severity is the rating reported by our scanner, taken from the Red Hat or GitHub advisory and falling back to NVD, so it can differ from the linked NVD entry. A row that lists two CVE IDs counts as two CVEs in the heading total. The Fixed In column shows what change (toolchain bump, dependency upgrade, base OS refresh) resolved the CVE. The Status column in the outstanding table explains why a fix is not yet available. Release 4.4.0 Fixed CVEs (54 total — 3 Critical, 51 High) CVE Severity CVSS Affected Component Fixed In Remediation CVE-2026-81642 CRITICAL 9.8 unbound-libs (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-56857 CRITICAL 9.8 stdlib (datadog-agent, datadog-cluster-agent) Go 1.26.10 Resolved by building the Datadog Agent and Cluster Agent with Go 1.26.10. CVE-2026-114406 CRITICAL 6.8 ca-certificates (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-82717 HIGH 9.8 unbound-libs (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-8925 HIGH 9.8 curl-minimal / libcurl-minimal (advance-functions-server, pinot, ui) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-44172 HIGH 9.1 mariadb-connector-c (advance-functions-server, ui) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-34040 HIGH 8.8 github.com/moby/moby (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. CVE-2026-44690 / CVE-2026-55973 HIGH 8.6 unbound-libs (kf-vector) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-74860 HIGH 8.5 libxml2 (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-77214 HIGH 8.2 expat (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-86145 HIGH 8.2 pcre2 (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-19445 HIGH 8.1 python3 (datadog-agent, datadog-cluster-agent, grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-86140 HIGH 7.8 libxml2 (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-89161 HIGH 7.8 pcre2 (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-11822 / CVE-2026-11824 HIGH 7.8 sqlite-libs (kf-vector) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-42129 HIGH 7.7 github.com/grafana/grafana (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. CVE-2026-103111 HIGH 7.6 pcre2 (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-102554 HIGH 7.5 com.google.guava:guava (logs-parser) guava 33.7.2-jre Resolved by pinning guava to 33.7.2-jre. Pinot is listed under Outstanding CVEs. CVE-2026-114605 HIGH 7.5 dnspython (datadog-agent) dnspython 2.9.0 Resolved by upgrading dnspython to 2.9.0. CVE-2026-116587 HIGH 7.5 github.com/go-jose/go-jose/v4 (archive-writer, az-service, hydration-service, rum-query-service, zapper, datadog-agent, datadog-cluster-agent, oauth2-proxy, envoy-gateway-fips) go-jose/v4 4.1.6 Resolved by upgrading go-jose to 4.1.6. The go-jose/v3 copy in oauth2-proxy is listed under Outstanding CVEs. CVE-2026-43871 HIGH 7.5 github.com/apache/thrift (grafana) github.com/apache/thrift 0.24.0 Resolved by upgrading github.com/apache/thrift to 0.24.0. CVE-2026-46600 HIGH 7.5 golang.org/x/net (grafana) golang.org/x/net 0.60.0 Resolved by upgrading golang.org/x/net to 0.60.0. CVE-2026-56851 HIGH 7.5 golang.org/x/text (grafana) golang.org/x/text 0.42.0 Resolved by upgrading golang.org/x/text to 0.42.0. CVE-2026-56852 HIGH 7.5 golang.org/x/text (grafana) golang.org/x/text 0.42.0 Resolved by upgrading golang.org/x/text to 0.42.0. CVE-2026-59999 HIGH 7.5 openssh (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-63209 HIGH 7.5 github.com/klauspost/compress (grafana) github.com/klauspost/compress 1.18.7 Resolved by upgrading github.com/klauspost/compress to 1.18.7. CVE-2026-66046 HIGH 7.5 expat (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-81634 HIGH 7.5 unbound-libs (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-84304 HIGH 7.5 google.golang.org/grpc (grafana) google.golang.org/grpc 1.83.2 Resolved by upgrading google.golang.org/grpc to 1.83.2. CVE-2026-84445 HIGH 7.5 google.golang.org/grpc (grafana) google.golang.org/grpc 1.83.2 Resolved by upgrading google.golang.org/grpc to 1.83.2. CVE-2026-93990 HIGH 7.5 expat (grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-108106 HIGH 7.5 org.xerial.snappy:snappy-java (zookeeper) snappy-java 1.1.10.9 Resolved by upgrading snappy-java to 1.1.10.9 in the ZooKeeper image. CVE-2026-42127 HIGH 7.5 github.com/grafana/grafana (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. CVE-2026-78667 HIGH 7.5 stdlib (datadog-agent, datadog-cluster-agent) Go 1.26.10 Resolved by building the Datadog Agent and Cluster Agent with Go 1.26.10. CVE-2026-78669 HIGH 7.5 stdlib (datadog-agent, datadog-cluster-agent) Go 1.26.10 Resolved by building the Datadog Agent and Cluster Agent with Go 1.26.10. CVE-2026-93451 HIGH 7.5 org.xerial.snappy:snappy-java (zookeeper) snappy-java 1.1.10.9 Resolved by upgrading snappy-java to 1.1.10.9 in the ZooKeeper image. CVE-2026-97031 HIGH 7.5 stdlib (datadog-agent, datadog-cluster-agent) Go 1.26.10 Resolved by building the Datadog Agent and Cluster Agent with Go 1.26.10. CVE-2026-41567 HIGH 7.5 github.com/moby/moby (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. envoy-gateway-fips is listed under Outstanding CVEs. CVE-2026-42154 HIGH 7.5 github.com/prometheus/prometheus (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. logs-query-service is listed under Outstanding CVEs. CVE-2026-50271 HIGH 7.5 ddtrace (datadog-agent) ddtrace 4.15.6 Resolved by upgrading ddtrace in the Datadog Agent image build. CVE-2026-11352 HIGH 7.5 curl-minimal / libcurl-minimal (advance-functions-server, pinot, ui) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-11586 HIGH 7.5 curl-minimal / libcurl-minimal (advance-functions-server, pinot, ui) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-19553 HIGH 7.4 python3 (datadog-agent, datadog-cluster-agent, grafana) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-9029 HIGH 7.3 github.com/grafana/grafana (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. CVE-2026-11940 HIGH 7.3 python3 / python3-libs / python-unversioned-command (kf-vector) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-42306 HIGH 7.2 github.com/moby/moby (grafana) Grafana 12.4.4 Resolved by upgrading Grafana from 12.4.2 to 12.4.4. envoy-gateway-fips is listed under Outstanding CVEs. CVE-2026-22020 HIGH 7.1 java-21-openjdk-headless (logs-parser, pinot, zookeeper), libpng (ui) RHEL 9.8 base image refresh Resolved by the refreshed RHEL 9 base image, which ships the patched package. CVE-2026-56854 HIGH 6.8 golang.org/x/crypto (grafana) golang.org/x/crypto 0.57.0 Resolved by upgrading golang.org/x/crypto to 0.57.0. CVE-2026-111943 HIGH 6.8 stdlib (datadog-agent, datadog-cluster-agent) Go 1.26.10 Resolved by building the Datadog Agent and Cluster Agent with Go 1.26.10. CVE-2026-106435 HIGH 5.1 pymongo (datadog-agent) pymongo 4.18.3 Resolved by upgrading pymongo to 4.18.3. CVE-2026-116588 HIGH N/A ddtrace (datadog-agent) ddtrace 4.15.6 Resolved by upgrading ddtrace to 4.15.6. CVE-2026-116589 HIGH N/A ddtrace (datadog-agent) ddtrace 4.15.6 Resolved by upgrading ddtrace to 4.15.6. Outstanding CVEs (High / Critical) CVE Severity CVSS Affected Component Status & Rationale GHSA-r277-6w6q-xmqw CRITICAL 9.1 github.com/getkin/kin-openapi (grafana) Grafana pins kin-openapi to a version that predates the fix; overriding the pin breaks the Grafana build. Will be addressed when Grafana drops the pin. CVE-2026-49272 HIGH 8.5 oauthlib (datadog-agent) Fixed only in oauthlib 4.0.0, a major version upgrade that has not yet been adopted. CVE-2026-88807 HIGH 8.3 libXrender (ui) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-97687 HIGH 8.1 python3-urllib3 (most images on the RHEL 9 base; not logs-parser or pinot) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-53615 HIGH 8.0 libblkid, libfdisk, libmount, libsmartcols, libuuid, util-linux, util-linux-core (all images on the RHEL 9 base) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-108976 HIGH 7.8 emacs-filesystem (advance-functions-server, ui) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-100349 HIGH 7.5 github.com/getkin/kin-openapi (grafana) Same upstream Grafana kin-openapi version pin as GHSA-r277-6w6q-xmqw. CVE-2026-100352 HIGH 7.5 github.com/getkin/kin-openapi (grafana) Same upstream Grafana kin-openapi version pin as GHSA-r277-6w6q-xmqw. CVE-2026-100354 HIGH 7.5 github.com/getkin/kin-openapi (grafana) Same upstream Grafana kin-openapi version pin as GHSA-r277-6w6q-xmqw. CVE-2026-102554 HIGH 7.5 com.google.guava:guava (pinot) Bundled in shaded Pinot plugin jars. Requires a dependency-management change across the Pinot modules. CVE-2026-114613 HIGH 7.5 python3-pip-wheel, python3.12-pip, python3.12-pip-wheel (most images on the RHEL 9 base; not logs-parser or pinot) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-116587 HIGH 7.5 github.com/go-jose/go-jose/v3 (oauth2-proxy) No fixed version is published in the go-jose v3 line. CVE-2026-21728 HIGH 7.5 github.com/grafana/tempo (grafana) Fix available upstream; the dependency is bundled in Grafana and a bump has not yet been validated against Grafana’s build. CVE-2026-28377 HIGH 7.5 github.com/grafana/tempo (grafana) Fix available upstream; the dependency is bundled in Grafana and a bump has not yet been validated against Grafana’s build. CVE-2026-41567 HIGH 7.5 github.com/docker/docker (envoy-gateway-fips) The fixed release is not published as a valid Go module version. Will be addressed when upstream tags a module release. CVE-2026-42151 HIGH 7.5 github.com/prometheus/prometheus (grafana, logs-query-service) Fixed upstream, but the bump is incompatible with the Loki dependency the component is built against. Under evaluation. CVE-2026-42154 HIGH 7.5 github.com/prometheus/prometheus (logs-query-service) Fixed upstream, but the bump is incompatible with the Loki dependency the component is built against. Under evaluation. CVE-2026-56860 HIGH 7.5 go-srpm-macros (ui) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. This is the go-srpm-macros RPM package, not the Go standard library issue listed as fixed in 4.3.0. CVE-2026-57585 HIGH 7.5 python3-pip-wheel, python3.12-pip, python3.12-pip-wheel (most images on the RHEL 9 base; not logs-parser or pinot) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-6554 HIGH 7.5 libpcap (zookeeper) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-76641 HIGH 7.5 expat (all images on the RHEL 9 base) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-76905 HIGH 7.5 github.com/getkin/kin-openapi (grafana) Same upstream Grafana kin-openapi version pin as GHSA-r277-6w6q-xmqw. CVE-2026-77354 HIGH 7.5 github.com/getkin/kin-openapi (grafana) Same upstream Grafana kin-openapi version pin as GHSA-r277-6w6q-xmqw. CVE-2026-85393 HIGH 7.5 node-forge (jackson-fips) No fixed version published yet. CVE-2026-88806 HIGH 7.5 libX11, libX11-common, libX11-devel, libX11-xcb (ui) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-97689 HIGH 7.5 python3-urllib3 (most images on the RHEL 9 base; not logs-parser or pinot) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-42306 HIGH 7.2 github.com/docker/docker (envoy-gateway-fips) The fixed release is not published as a valid Go module version. Will be addressed when upstream tags a module release. CVE-2026-112940 HIGH 7.1 filelock (datadog-agent) Fixed in filelock 4.2.1, but the bundled snowflake-connector-python requires filelock below 4. CVE-2026-53613 HIGH 7.0 libblkid, libfdisk, libmount, libsmartcols, libuuid, util-linux, util-linux-core (all images on the RHEL 9 base) No fixed version published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-91403 HIGH 6.8 java-21-openjdk-headless (logs-parser, pinot, zookeeper) No fix published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. CVE-2026-91415 HIGH 4.8 java-21-openjdk-headless (logs-parser, pinot, zookeeper) No fix published by Red Hat yet. Will be picked up in the next RHEL 9 errata refresh. Release 4.3.0 Fixed CVEs (28 total — 4 Critical, 24 High) CVE Severity CVSS Affected Component Fixed In Remediation CVE-2026-15925 CRITICAL 9.2 snowflake-connector-python (datadog-agent) snowflake-connector-python 4.7.3 Resolved by upgrading the pinned snowflake-connector-python package bundled by the Datadog Agent image build. CVE-2026-53713 CRITICAL 9.1 github.com/envoyproxy/gateway (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Envoy Gateway vulnerability resolved by upgrading the bundled Datadog Agent release, which carries envoyproxy/gateway forward from v1.7.1 to v1.7.4. CVE-2026-75595 CRITICAL 9.1 io.netty:netty-handler (ZooKeeper, logs-parser, Pinot) netty 4.1.137.Final / 4.1.138.Final Heap overflow in netty’s DNS-over-HTTPS response parsing, resolved by upgrading the pinned netty version across the affected services. CVE-2026-75604 CRITICAL 9.0 next (jackson-fips) next 16.3.4 Unauthenticated remote code execution in the Next.js Image Optimization API, resolved by upgrading next while staying on the 16.x line. CVE-2026-33818 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7 across all affected service images. CVE-2026-39821 HIGH 8.2 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-46600 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-56853 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-56858 HIGH 8.1 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-56859 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-56860 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. CVE-2026-56862 HIGH 7.5 Go stdlib (all FIPS service images) Go 1.26.7 FIPS toolchain Go standard library vulnerability resolved by upgrading the FIPS Go toolchain to Go 1.26.7. GHSA-f88m-g3jw-g9cj HIGH 7.0 sharp (jackson-fips) sharp 0.35.0 Arbitrary code execution vulnerability in the sharp image-processing library. Resolved by forcing the transitive dependency to version 0.35.0 or later. CVE-2026-53714 HIGH 7.4 github.com/envoyproxy/gateway (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Envoy Gateway vulnerability resolved by upgrading the bundled Datadog Agent release, which carries envoyproxy/gateway forward from v1.7.1 to v1.7.4. CVE-2026-46600 HIGH 7.5 golang.org/x/net (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Resolved by upgrading the bundled Datadog Agent release, which carries golang.org/x/net forward from v0.55.0 to v0.57.0. CVE-2026-56852 HIGH 7.5 golang.org/x/text (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Resolved by upgrading the bundled Datadog Agent release, which carries golang.org/x/text forward from v0.37.0 to v0.40.0. GHSA-hrxh-6v49-42gf HIGH 8.8 google.golang.org/grpc (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Resolved by upgrading the bundled Datadog Agent release, which carries grpc forward from v1.81.1 to v1.82.1. CVE-2026-84304 HIGH 8.7 google.golang.org/grpc (datadog-agent, datadog-cluster-agent) grpc v1.83.2 A subsequent grpc HIGH CVE re-pinned directly to v1.83.2, since the Datadog Agent’s own vendored grpc release had not yet caught up. CVE-2026-84445 HIGH — google.golang.org/grpc (datadog-agent, datadog-cluster-agent) grpc v1.83.2 Denial-of-service in grpc-go xDS servers, resolved by the same v1.83.2 re-pin as CVE-2026-84304. CVE-2026-53488 HIGH 8.8 containerd/containerd (datadog-agent, datadog-cluster-agent) Datadog Agent 7.82.3 Resolved by upgrading the bundled Datadog Agent release, which migrated off the vulnerable v1 containerd module entirely in favor of containerd/containerd/v2. CVE-2026-56864 / CVE-2026-56865 HIGH 7.5 / 8.8 golang.org/x/mod (datadog-agent, datadog-cluster-agent) golang.org/x/mod 0.40.0 The Datadog Agent 7.82.3 release did not fully carry this dependency forward, so it was patched directly to version 0.40.0. CVE-2026-56740 / CVE-2026-56741 HIGH 7.5 org.jline:jline-remote-telnet (Pinot) jline 3.30.14 Resolved by upgrading the pinned jline.version, which covers the jline-remote-telnet artifact from the same multi-module release. CVE-2026-54428 HIGH 7.5 org.apache.httpcomponents.core5:httpcore5-h2 (Pinot) httpcore5 5.4.3 Denial of service via oversized HTTP/2 HPACK header blocks, resolved by bumping the pinned httpcore5 version and adding an explicit dependency-management entry for httpcore5-h2. CVE-2026-54399 HIGH 7.5 org.apache.httpcomponents.core5:httpcore5 (Pinot) httpcore5 5.4.3 Resolved by the same httpcore5 version bump as CVE-2026-54428. CVE-2026-59902 HIGH 7.5 io.netty:netty-transport-sctp (Pinot) netty 4.1.137.Final Resolved by the same pinned netty version bump that addressed the httpcore5 and jline CVEs above. GHSA-3f6p-5ww8-9rcr HIGH 8.2 mysql2 (jackson-fips) mysql2 3.22.0 Auth-plugin downgrade in mysql2 that could leak plaintext credentials, resolved by upgrading the pinned dependency. GHSA-2x7j-588g-ccc2 HIGH 7.5 nodemailer (jackson-fips) nodemailer 9.1.1 Quadratic-time denial of service in nodemailer’s address parser, resolved by upgrading the pinned dependency. CVE-2026-11822 / CVE-2026-11824 HIGH 7.5 sqlite-libs (Base OS, all ubi9-minimal-cc-based images) RHEL 9.8 errata base image refresh Resolved by refreshing the ubi9-minimal-cc / ubi9-cc-go-builder base image digest to the latest available RHEL 9.8 errata across the fleet. Still outstanding for kf-vector at the time of the 4.3.0 release (resolved in 4.4.0) — see below. Outstanding CVEs (High / Critical) CVE Severity Affected Component Status & Rationale GHSA-r277-6w6q-xmqw CRITICAL github.com/getkin/kin-openapi (grafana) Blocked by an upstream Grafana dependency pin that has not yet been updated. CVE-2026-56854 CRITICAL golang.org/x/crypto (grafana) Deferred pending a full Grafana version upgrade, rather than patching individual transitive dependencies piecemeal. CVE-2026-76905 HIGH github.com/getkin/kin-openapi (grafana) Same upstream Grafana dependency pin as above. CVE-2026-77354 HIGH github.com/getkin/kin-openapi (grafana) Same upstream Grafana dependency pin as above. CVE-2026-84304 HIGH google.golang.org/grpc (grafana) Same Grafana version-upgrade deferral as above. This CVE is already fixed for datadog-agent — see the Fixed CVEs table. CVE-2026-84445 HIGH google.golang.org/grpc (grafana) Same as above. CVE-2026-46600 HIGH golang.org/x/net (grafana) Same Grafana version-upgrade deferral as above. This CVE is already fixed for datadog-agent and the FIPS service images — see the Fixed CVEs table. CVE-2026-56852 HIGH golang.org/x/text (grafana) Same Grafana version-upgrade deferral as above. This CVE is already fixed for datadog-agent — see the Fixed CVEs table. CVE-2026-43871 HIGH github.com/apache/thrift (grafana) Same Grafana version-upgrade deferral as above. CVE-2026-21728 HIGH github.com/grafana/tempo (grafana) Tracks the same upstream dependency chain as the prometheus CVEs below. CVE-2026-28377 HIGH github.com/grafana/tempo (grafana) Tracks the same upstream dependency chain as the prometheus CVEs below. CVE-2026-42151 HIGH github.com/prometheus/prometheus (grafana, logs-query-service) Requires a coordinated dependency upgrade with compatibility validation before it can be applied. CVE-2026-42154 HIGH github.com/prometheus/prometheus (grafana, logs-query-service) Same as above. CVE-2026-50271 HIGH ddtrace (datadog-agent, datadog-cluster-agent) Fix requires a major-version upgrade (3.x to 4.x); deliberately not attempted this cycle. CVE-2026-41567 HIGH github.com/docker/docker, github.com/moby/moby (envoy-gateway-fips, grafana) No fixed version has been published as a consumable Go module — the fix corresponds to a Docker product release, not a Go module tag currently available upstream. CVE-2026-42306 HIGH github.com/docker/docker, github.com/moby/moby (envoy-gateway-fips, grafana) Same as above. CVE-2026-34040 HIGH github.com/moby/moby (grafana) Same as above. CVE-2026-11822 / CVE-2026-11824 HIGH sqlite-libs (kf-vector) kf-vector is built on the UBI9 base image, but its image had not yet been rebuilt on the latest RHEL 9.8 errata when 4.3.0 was released. Resolved in 4.4.0 by the RHEL 9.8 base image refresh; see the Release 4.4.0 Fixed CVEs table. CVE-2026-11940 HIGH python3 / python3-libs / python-unversioned-command (kf-vector) Same kf-vector image rebuild as above, resolved in 4.4.0. CVE-2026-44690 / CVE-2026-55973 HIGH unbound-libs (kf-vector) Same kf-vector image rebuild as above, resolved in 4.4.0. CVE-2026-11352 HIGH curl-minimal / libcurl-minimal (advance-functions, Pinot, UI) Not yet published by Red Hat for the RHEL 9.8 stream. CVE-2026-11586 HIGH curl-minimal / libcurl-minimal (advance-functions, Pinot, UI) Not yet published by Red Hat for the RHEL 9.8 stream. CVE-2026-8925 HIGH curl-minimal / libcurl-minimal (advance-functions, Pinot, UI) Not yet published by Red Hat for the RHEL 9.8 stream. CVE-2026-22020 HIGH java-21-openjdk-headless (logs-parser, Pinot, ZooKeeper), libpng (UI) Not yet published by Red Hat for the RHEL 9.8 stream. CVE-2026-44172 HIGH mariadb-connector-c (advance-functions, UI) Not yet published by Red Hat for the RHEL 9.8 stream.