*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-19137 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***

CVE-2026-9703 is a confirmed, exploitable authorization bypass vulnerability affecting all Red Hat products that ship Grafana OSS. The missing access-control check on the data source proxy is in the core OSS alerting subsystem — code fully compiled and reachable in Red Hat builds (confirmed via RPM spec 'oss' build tag analysis and container image inspection). Any authenticated Viewer-role user can create, modify, or delete Loki/Prometheus alerting rules without authorization. No configuration workaround exists; upgrade is required. The vulnerability is exploitable over normal authenticated HTTPS traffic, bypassing all container-level and OS-level security controls (SELinux, seccomp, NetworkPolicies). RHACM 2 has the highest exposure due to multi-tenant OpenShift clusters with Viewer-role users accessing Grafana via OpenShift Routes. Four of the six disclosed CVEs (CVE-2026-10088, CVE-2026-13000, CVE-2026-11574, CVE-2026-10084) target Enterprise-only features (Recorded Queries, Git Sync, SAML) whose code is excluded at compile time by the Go 'oss' build tag — these are NOT APPLICABLE and should be marked not-affected. CVE-2026-11817 (cross-org permission metadata disclosure, CVSS 5.3) is potentially applicable as the multi-org API exists in OSS, but practical impact is low: multi-org deployments are uncommon in Red Hat product contexts, exploitation requires Org Admin privilege, and only dashboard/folder IDs and permission mappings are exposed (no content, credentials, or personal data). CVE-2026-11817 should be tracked as a secondary Low-impact flaw.