Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Grafana could grant excess IP access or dashboard rights
published 4 months ago
Summary
The Grafana packages for Almalinux may unintentionally allow a broader range of IPv6 addresses to connect and could let an Editor gain full control of an existing dashboard. This can expose your monitoring system to unwanted changes or data exposure. Apply the latest Grafana updates from Almalinux as soon as possible to correct the IP filtering and permission handling.
What to do
- Update almalinux grafana to version 10.2.6-15.el9_6.tuxcare.els10.
- Update almalinux grafana-selinux to version 10.2.6-15.el9_6.tuxcare.els10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | grafana |
< 10.2.6-15.el9_6.tuxcare.els10 Fix: upgrade to 10.2.6-15.el9_6.tuxcare.els10
|
| TuxCare:AlmaLinux:9.6 | almalinux | grafana-selinux |
< 10.2.6-15.el9_6.tuxcare.els10 Fix: upgrade to 10.2.6-15.el9_6.tuxcare.els10
|
Original advisory text
grafana: Fix of 2 CVEs
- CVE-2026-33376: fix auth proxy IPv6 allow-list entries without an explicit
mask being coerced to /32 instead of /128, which widened the allowed source
address range
- CVE-2026-33377: fix privilege escalation where an Editor overwriting an
existing dashboard via the import API had default permissions re-applied,
granting them Admin on that dashboard; default permissions are now only set
for newly created dashboards
mask being coerced to /32 instead of /128, which widened the allowed source
address range
- CVE-2026-33377: fix privilege escalation where an Editor overwriting an
existing dashboard via the import API had default permissions re-applied,
granting them Admin on that dashboard; default permissions are now only set
for newly created dashboards
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781253433.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33376 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33377 Vendor Advisory
Timeline
Published12 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1781253433 · OSV
Track software like this
Free during beta