Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
Grafana: Unsecured Data Exposure via Incorrect Label Processing
published 4 months ago
Summary
Grafana users need to update their software to prevent unauthorized access to their data. If not updated, attackers could exploit this weakness to gain elevated privileges, potentially exposing sensitive information. Update Grafana to the latest version to protect your data.
What to do
- Update rocky grafana to version 0:10.2.6-27.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | grafana |
< 0:10.2.6-27.el10_2 Fix: upgrade to 0:10.2.6-27.el10_2
|
Original advisory text
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:35827 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published7 Jul 2026
Updated7 Jul 2026
First seen7 Jul 2026
Sources
RLSA-2026:35827 · OSV
Track software like this
Free during beta