{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-21720: bound the avatar cache to 2000 entries so a signed-in user\n cannot grow it without limit\n- CVE-2026-28383: carry the upstream test for the oversized plugin resource\n request body", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/advisories/2026/clsa-2026_1791553174.json" } ], "tracking": { "current_release_date": "2026-10-09T13:40:53Z", "generator": { "date": "2026-10-09T13:40:53Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791553174", "initial_release_date": "2026-10-09T13:40:53Z", "revision_history": [ { "date": "2026-10-09T13:40:53Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "grafana: Fix of 9 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.8", "product": { "name": "AlmaLinux 9.8", "product_id": "AlmaLinux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.8", "product": { "name": "Rocky Linux 9.8", "product_id": "Rocky Linux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els5?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els5?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els2?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els2?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product_id": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana@10.2.6-23.el9_8.3.tuxcare.els1?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product_id": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/grafana-selinux@10.2.6-23.el9_8.3.tuxcare.els1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64" }, "product_reference": "grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64" }, "product_reference": "grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28383", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28383" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-28383", "url": "https://grafana.com/security/security-advisories/cve-2026-28383" } ], "release_date": "2026-05-13T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-05-13T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-21722", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "description", "text": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21722" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-21722", "url": "https://grafana.com/security/security-advisories/cve-2026-21722" } ], "release_date": "2026-02-12T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-02-12T09:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-4123", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "description", "text": "A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-4123" }, { "category": "external", "summary": "https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/", "url": "https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2025-4123/", "url": "https://grafana.com/security/security-advisories/cve-2025-4123/" }, { "category": "external", "summary": "https://www.exploit-db.com/exploits/52491", "url": "https://www.exploit-db.com/exploits/52491" } ], "release_date": "2025-05-22T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2025-05-22T08:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-21720", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21720" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-21720", "url": "https://grafana.com/security/security-advisories/cve-2026-21720" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-21720", "url": "https://access.redhat.com/security/cve/CVE-2026-21720" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433226" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21720.json" } ], "release_date": "2026-01-27T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-01-27T09:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-28376", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28376" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-28376", "url": "https://grafana.com/security/security-advisories/cve-2026-28376" } ], "release_date": "2026-05-13T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-05-13T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-28380", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "description", "text": "Any Editor could delete any snapshot, even if they have no access to read or write them.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28380" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-28380", "url": "https://grafana.com/security/security-advisories/cve-2026-28380" } ], "release_date": "2026-05-13T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-05-13T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-28379", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28379" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-28379", "url": "https://grafana.com/security/security-advisories/cve-2026-28379" } ], "release_date": "2026-05-13T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-05-13T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-21727", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "description", "text": "A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-21727" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-21727", "url": "https://grafana.com/security/security-advisories/cve-2026-21727" } ], "release_date": "2026-04-15T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-04-15T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-33378", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "known_affected": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33378" }, { "category": "external", "summary": "https://grafana.com/security/security-advisories/cve-2026-33378", "url": "https://grafana.com/security/security-advisories/cve-2026-33378" } ], "release_date": "2026-05-13T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T13:39:36.449077Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791553174" }, { "category": "none_available", "date": "2026-05-13T20:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "AlmaLinux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els1.x86_64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.aarch64", "Rocky Linux-9.8:grafana-selinux-0:10.2.6-23.el9_8.3.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }