Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Grafana Updates Fix Security Flaw
published 1 year ago
Summary
Grafana, a popular data visualization tool, has released updates to fix a security vulnerability that could allow an attacker to inject and execute malicious code on a system. This vulnerability affects Grafana installations that have not been updated to the latest version. We recommend updating Grafana to the latest version to ensure your system remains secure.
What to do
- Update redhat grafana to version 0:9.2.10-25.el8_10.
- Update redhat grafana-debuginfo to version 0:9.2.10-25.el8_10.
- Update redhat grafana-debugsource to version 0:9.2.10-25.el8_10.
- Update redhat grafana-selinux to version 0:9.2.10-25.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::appstream | redhat | grafana |
< 0:9.2.10-25.el8_10 Fix: upgrade to 0:9.2.10-25.el8_10
|
| Red Hat:enterprise_linux:8::appstream | redhat | grafana-debuginfo |
< 0:9.2.10-25.el8_10 Fix: upgrade to 0:9.2.10-25.el8_10
|
| Red Hat:enterprise_linux:8::appstream | redhat | grafana-debugsource |
< 0:9.2.10-25.el8_10 Fix: upgrade to 0:9.2.10-25.el8_10
|
| Red Hat:enterprise_linux:8::appstream | redhat | grafana-selinux |
< 0:9.2.10-25.el8_10 Fix: upgrade to 0:9.2.10-25.el8_10
|
Original advisory text
Red Hat Security Advisory: grafana security update
References
- https://access.redhat.com/errata/RHSA-2025:8667 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8667.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-22871 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22871 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871 Vendor Advisory
- https://go.dev/cl/652998 Third Party Advisory
- https://go.dev/issue/71988 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-3563 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published10 Jun 2025
Updated6 Mar 2026
First seen6 Mar 2026
Sources
RHSA-2025:8667 · OSV
Track software like this
Free during beta