Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Grafana and Prometheus Server Vulnerabilities in Red Hat Product

published 6 months ago

Summary

Red Hat has released a security update for Grafana and Prometheus Server. This update fixes vulnerabilities that could allow an attacker to execute arbitrary code on a system or bypass authentication. Affected users should apply the update as soon as possible to ensure the security of their system.

What to do

Update redhat grafana-pcp to version 0:5.1.1-5.el9_2.
Update redhat grafana-pcp-debuginfo to version 0:5.1.1-5.el9_2.
Update redhat grafana-pcp-debugsource to version 0:5.1.1-5.el9_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	grafana-pcp	< 0:5.1.1-5.el9_2 Fix: upgrade to 0:5.1.1-5.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	grafana-pcp-debuginfo	< 0:5.1.1-5.el9_2 Fix: upgrade to 0:5.1.1-5.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	grafana-pcp-debugsource	< 0:5.1.1-5.el9_2 Fix: upgrade to 0:5.1.1-5.el9_2

Original advisory text

Red Hat Security Advisory: grafana-pcp security update

References

https://access.redhat.com/errata/RHSA-2026:9090 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9090.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
https://go.dev/cl/752180 Third Party Advisory
https://go.dev/issue/77578 Third Party Advisory
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published21 Apr 2026

Updated27 Apr 2026

First seen27 Apr 2026

Sources

RHSA-2026:9090 · OSV

Track software like this

Free during beta