SB2026101447 - Multiple vulnerabilities in IBM Security QRadar Log Management AQL Plugin
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2026-76905)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in openapi3filter.ConvertErrors. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
2) Cross-site scripting (CVE-ID: CVE-2026-17033)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's Grafana session.
The vulnerability exists due to improper neutralization of input during web page generation in the external Alertmanager alert generatorURL handling when rendering the Alert Details See source link. A remote user can submit an external Alertmanager alert containing a crafted generatorURL to execute arbitrary JavaScript in another user's Grafana session.
User interaction is required to click the See source link, and the script executes in the Grafana origin with the clicking user's permissions.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.