Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Grafana may expose data and allow unauthorized access
published 16 days ago
Summary
The current Grafana installation can unintentionally reveal data stored in its data sources and, in some cases, let users get past the login checks. It can also let attackers inject hidden code or overload the system. Install the latest Grafana 12.4.10 release to close these gaps.
What to do
- Update opensuse grafana to version 12.4.10-bp160.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | grafana |
< 12.4.10-bp160.1.1 Fix: upgrade to 12.4.10-bp160.1.1
|
Original advisory text
Security update for grafana
This update for grafana fixes the following issues:
Changes in grafana:
Update to version 12.4.10:
* Security:
* CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
* CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
* CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
* CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
* CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
* CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
* Bug fixes:
* Dashboards: Fix adhoc and groupby variable datasource on UI import
* Dashboards: Fix version dates and user display names in the legacy version history page
Update to version 12.4.9:
* Features and enhancements:
* Dashboard Import: Labels in v2 schema
* Bug fixes:
* Azure Monitor: fix migration for dimension filters
Update to version 12.4.8:
* Security:
* CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)
Update to version 12.4.7:
* Security:
* CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
* Features and enhancements:
* Dashboards: Get annotations and dashboard endpoint performance improvements
* Bug fixes:
* DashboardDS: Fix Mixed panels with a time override stuck in permanent loading
Update to version 12.4.6:
* Security:
* CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
* Features and enhancements:
* Alerting: Add protected fields authorization check to provisioning API
* Alerting: Return 403 instead of 500 on contact point provenance mismatch
* Bug fixes:
* Jaeger: Handle gzip, deflate, and brotli compressed API responses
* Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
* CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)
* CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)
* CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)
* CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
* CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
* CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
Changes in grafana:
Update to version 12.4.10:
* Security:
* CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
* CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
* CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
* CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
* CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
* CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
* Bug fixes:
* Dashboards: Fix adhoc and groupby variable datasource on UI import
* Dashboards: Fix version dates and user display names in the legacy version history page
Update to version 12.4.9:
* Features and enhancements:
* Dashboard Import: Labels in v2 schema
* Bug fixes:
* Azure Monitor: fix migration for dimension filters
Update to version 12.4.8:
* Security:
* CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)
Update to version 12.4.7:
* Security:
* CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
* Features and enhancements:
* Dashboards: Get annotations and dashboard endpoint performance improvements
* Bug fixes:
* DashboardDS: Fix Mixed panels with a time override stuck in permanent loading
Update to version 12.4.6:
* Security:
* CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
* Features and enhancements:
* Alerting: Add protected fields authorization check to provisioning API
* Alerting: Return 403 instead of 500 on contact point provenance mismatch
* Bug fixes:
* Jaeger: Handle gzip, deflate, and brotli compressed API responses
* Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
* CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)
* CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)
* CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)
* CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
* CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
* CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
References
- https://bugzilla.suse.com/1263330 Third Party Advisory
- https://bugzilla.suse.com/1265525 Third Party Advisory
- https://bugzilla.suse.com/1265763 Third Party Advisory
- https://bugzilla.suse.com/1268868 Third Party Advisory
- https://bugzilla.suse.com/1269841 Third Party Advisory
- https://bugzilla.suse.com/1271330 Third Party Advisory
- https://bugzilla.suse.com/1272008 Third Party Advisory
- https://bugzilla.suse.com/1272328 Third Party Advisory
- https://bugzilla.suse.com/1272427 Third Party Advisory
- https://bugzilla.suse.com/1274217 Third Party Advisory
- https://bugzilla.suse.com/1275934 Third Party Advisory
- https://bugzilla.suse.com/1276426 Third Party Advisory
- https://bugzilla.suse.com/1276658 Third Party Advisory
- https://bugzilla.suse.com/1276973 Third Party Advisory
- https://bugzilla.suse.com/1277025 Third Party Advisory
- https://bugzilla.suse.com/1278307 Third Party Advisory
- https://bugzilla.suse.com/1278322 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-1229 URL
- https://www.suse.com/security/cve/CVE-2026-14199 URL
- https://www.suse.com/security/cve/CVE-2026-17033 URL
- https://www.suse.com/security/cve/CVE-2026-17183 URL
- https://www.suse.com/security/cve/CVE-2026-19197 URL
- https://www.suse.com/security/cve/CVE-2026-19475 URL
- https://www.suse.com/security/cve/CVE-2026-21723 URL
- https://www.suse.com/security/cve/CVE-2026-2303 URL
- https://www.suse.com/security/cve/CVE-2026-33814 URL
- https://www.suse.com/security/cve/CVE-2026-39882 URL
- https://www.suse.com/security/cve/CVE-2026-41178 URL
- https://www.suse.com/security/cve/CVE-2026-41606 URL
- https://www.suse.com/security/cve/CVE-2026-42127 URL
- https://www.suse.com/security/cve/CVE-2026-56852 URL
- https://www.suse.com/security/cve/CVE-2026-73501 URL
- https://www.suse.com/security/cve/CVE-2026-8609 URL
- https://www.suse.com/security/cve/CVE-2026-9029 URL
Timeline
Published19 Oct 2026
Updated20 Oct 2026
First seen20 Oct 2026
Sources
openSUSE-SU-2026:22125-1 · OSV
Track software like this
Free during beta