Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Grafana on AlmaLinux can expose legacy correlation records
published 1 month ago
Summary
Grafana running on AlmaLinux may allow users in one organization to see or delete correlation data that was created before version 10.2 in another organization. This could let confidential information leak between separate groups. Upgrade Grafana to the latest release, which removes the backward‑compatibility setting, and verify that older correlation records are no longer accessible across organizations.
What to do
- Update almalinux grafana to version 10.2.6-15.el9_6.tuxcare.els17.
- Update almalinux grafana-selinux to version 10.2.6-15.el9_6.tuxcare.els17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | grafana |
< 10.2.6-15.el9_6.tuxcare.els17 Fix: upgrade to 10.2.6-15.el9_6.tuxcare.els17
|
| TuxCare:AlmaLinux:9.6 | almalinux | grafana-selinux |
< 10.2.6-15.el9_6.tuxcare.els17 Fix: upgrade to 10.2.6-15.el9_6.tuxcare.els17
|
Original advisory text
grafana: Fix of 3 CVEs
- CVE-2026-21727: drop the org_id = 0 backward-compatibility condition from the
correlations read and delete paths so legacy correlation records created before
Grafana 10.2 can no longer be read or deleted across organizations
correlations read and delete paths so legacy correlation records created before
Grafana 10.2 can no longer be read or deleted across organizations
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789289678.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-21727 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42502 Vendor Advisory
Timeline
Published22 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789289678 · OSV
Track software like this
Free during beta