Most recent entries from all

ALSA-2026:10223 — Important: grafana security update

2026-10-04T09:41:51.319892+00:00

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-08995

2026-10-04T09:41:51.319962+00:00

bdu:2026-08995

BIT-grafana-2026-27877 — Public dashboards discloses all direct mode datasources

2026-10-04T09:41:51.319980+00:00

Affected: Bitnami: grafana

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

EUVD-2026-360227

2026-10-04T09:41:51.320004+00:00

EUVD-2026-360227

fkie_cve-2026-27877

2026-10-04T09:41:51.320016+00:00

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

GHSA-3q27-7qjq-p9c5 — Grafana public dashboards disclose all direct mode datasources

2026-10-04T09:41:51.320039+00:00

Affected: Go: github.com/grafana/grafana

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

RHSA-2026:10223 — Red Hat Security Advisory: grafana security update

2026-10-04T09:41:51.320066+00:00

grafana: Grafana: Information disclosure of data-source passwords via public dashboards

RHSA-2026:11417 — Red Hat Security Advisory: grafana security update

2026-10-04T09:41:51.320083+00:00

grafana: Grafana: Information disclosure of data-source passwords via public dashboards

RLSA-2026:19134 — Important: grafana security update

2026-10-04T09:41:51.320098+00:00

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-27877

2026-10-04T09:41:51.320122+00:00

Affected: Ubuntu:16.04:LTS: grafana

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

WID-SEC-W-2026-0899 — Grafana: Mehrere Schwachstellen

2026-10-04T09:41:51.320140+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen, Code auszuführen oder Informationen offenzulegen.