rpm package
opensuse/grafana&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
Vulnerabilities (125)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-19475 | Med | 6.5 | < 12.4.10-1.1 | 12.4.10-1.1 | Sep 2, 2026 | An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory cons | |
| CVE-2026-14199 | Hig | 7.1 | < 12.4.10-1.1 | 12.4.10-1.1 | Sep 2, 2026 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collid | |
| CVE-2026-19197 | Med | 6.3 | < 12.4.10-1.1 | 12.4.10-1.1 | Aug 26, 2026 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control). | |
| CVE-2026-17033 | Med | 6.8 | < 12.4.10-1.1 | 12.4.10-1.1 | Aug 24, 2026 | An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana ren | |
| CVE-2026-17183 | Hig | 7.1 | < 12.4.10-1.1 | 12.4.10-1.1 | Aug 19, 2026 | An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Graf | |
| CVE-2026-73501 | Cri | 9.1 | < 12.4.10-1.1 | 12.4.10-1.1 | Aug 12, 2026 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution cau | |
| CVE-2026-21723 | Med | 5.3 | < 12.4.5-4.1 | 12.4.5-4.1 | Jul 23, 2026 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is e | |
| CVE-2026-56852 | Hig | 7.5 | < 12.4.10-1.1 | 12.4.10-1.1 | Jul 21, 2026 | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | |
| CVE-2026-8609 | Med | 5.3 | < 12.4.5-4.1 | 12.4.5-4.1 | Jul 10, 2026 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). | |
| CVE-2026-8595 | Med | 6.8 | < 12.4.5-3.1 | 12.4.5-3.1 | Jul 10, 2026 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting). | |
| CVE-2026-33382 | Hig | 7.5 | < 12.4.5-1.1 | 12.4.5-1.1 | Jul 10, 2026 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service. | |
| CVE-2026-42127 | Hig | 7.5 | < 12.4.5-3.1 | 12.4.5-3.1 | Jun 22, 2026 | The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid das | |
| CVE-2026-9029 | Hig | 7.3 | < 12.4.5-4.1 | 12.4.5-4.1 | Jun 22, 2026 | A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting). | |
| CVE-2026-41178 | Med | 5.3 | < 12.4.10-1.1 | 12.4.10-1.1 | Jun 4, 2026 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the iss | |
| CVE-2026-42506 | Med | 6.1 | < 11.6.14+security04-3.1 | 11.6.14+security04-3.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-39821 | Cri | 9.6 | < 11.6.14+security04-2.1 | 11.6.14+security04-2.1 | May 22, 2026 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program | |
| CVE-2026-25680 | Med | 6.5 | < 11.6.14+security04-3.1 | 11.6.14+security04-3.1 | May 22, 2026 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | |
| CVE-2026-33381 | Med | 5.9 | < 11.6.14+security04-1.1 | 11.6.14+security04-1.1 | May 13, 2026 | When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. | |
| CVE-2026-33380 | Med | 6.3 | < 11.6.14+security04-1.1 | 11.6.14+security04-1.1 | May 13, 2026 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable. | |
| CVE-2026-33378 | Med | 6.5 | < 11.6.14+security04-1.1 | 11.6.14+security04-1.1 | May 13, 2026 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server. |
- affected < 12.4.10-1.1fixed 12.4.10-1.1
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory cons
- affected < 12.4.10-1.1fixed 12.4.10-1.1
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collid
- affected < 12.4.10-1.1fixed 12.4.10-1.1
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
- affected < 12.4.10-1.1fixed 12.4.10-1.1
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana ren
- affected < 12.4.10-1.1fixed 12.4.10-1.1
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Graf
- affected < 12.4.10-1.1fixed 12.4.10-1.1
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution cau
- affected < 12.4.5-4.1fixed 12.4.5-4.1
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is e
- affected < 12.4.10-1.1fixed 12.4.10-1.1
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
- affected < 12.4.5-4.1fixed 12.4.5-4.1
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
- affected < 12.4.5-3.1fixed 12.4.5-3.1
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
- affected < 12.4.5-1.1fixed 12.4.5-1.1
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
- affected < 12.4.5-3.1fixed 12.4.5-3.1
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid das
- affected < 12.4.5-4.1fixed 12.4.5-4.1
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
- affected < 12.4.10-1.1fixed 12.4.10-1.1
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the iss
- affected < 11.6.14+security04-3.1fixed 11.6.14+security04-3.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 11.6.14+security04-2.1fixed 11.6.14+security04-2.1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program
- affected < 11.6.14+security04-3.1fixed 11.6.14+security04-3.1
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- affected < 11.6.14+security04-1.1fixed 11.6.14+security04-1.1
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
- affected < 11.6.14+security04-1.1fixed 11.6.14+security04-1.1
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
- affected < 11.6.14+security04-1.1fixed 11.6.14+security04-1.1
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
Page 1 of 7