Most recent entries from all

ALSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07040

BIT-grafana-2026-33376 — Auth Proxy IPv6 whitelist bypass

Affected: Bitnami: grafana

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

EUVD-2026-360230

fkie_cve-2026-33376

GHSA-3r2p-7499-27q3

RHSA-2026:42852 — Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default grafana: Grafana: Privilege escalation via dashboard overwrite net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

RHSA-2026:54178 — Red Hat Security Advisory: grafana security, bug fix, and enhancement update

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default grafana: Grafana: Privilege escalation via dashboard overwrite grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

RLSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:2774-1 — Security update 5.1.4 for Multi-Linux Manager Server

Security update 5.1.4 for Multi-Linux Manager Server

UBUNTU-CVE-2026-33376

Affected: Ubuntu:16.04:LTS: grafana

WID-SEC-W-2026-1546 — Grafana: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.