Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Grafana PCP Plugin May Allow Remote Code Execution
published 6 months ago
Summary
A security update is available for the Grafana PCP plugin to prevent unauthorized access and code execution. Affected users should update the plugin as soon as possible to ensure the security of their Grafana instance.
What to do
- Update redhat grafana-pcp to version 0:3.2.0-6.el9_0.
- Update redhat grafana-pcp-debuginfo to version 0:3.2.0-6.el9_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_e4s:9.0::appstream | redhat | grafana-pcp |
< 0:3.2.0-6.el9_0 Fix: upgrade to 0:3.2.0-6.el9_0
|
| Red Hat:rhel_e4s:9.0::appstream | redhat | grafana-pcp-debuginfo |
< 0:3.2.0-6.el9_0 Fix: upgrade to 0:3.2.0-6.el9_0
|
Original advisory text
Red Hat Security Advisory: grafana-pcp security update
References
- https://access.redhat.com/errata/RHSA-2026:8949 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8949.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
- https://go.dev/cl/752180 Third Party Advisory
- https://go.dev/issue/77578 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published21 Apr 2026
Updated27 Apr 2026
First seen27 Apr 2026
Sources
RHSA-2026:8949 · OSV
Track software like this
Free during beta