CVE-2026-33376

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

• grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

• grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

• [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

Bug Fix(es) and Enhancement(s):

• Avoid unbounded memory growth [rhel-9.8.z] (JIRA:Rocky Linux-242865)

• Limit the size of the request body before processing it (JIRA:Rocky Linux-242866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)
• grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)
• grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

• [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

Bug Fix(es) and Enhancement(s):

• Avoid unbounded memory growth [almalinux-9.8.z] (JIRA:AlmaLinux-242865)
• Limit the size of the request body before processing it (JIRA:AlmaLinux-242866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

• CVE-2026-33376: fix auth proxy IPv6 allow-list bypass (use /128 mask for IPv6, not /32)
• CVE-2026-33377: fix dashboard import privilege escalation (set default dashboard permissions only for newly created dashboards, not when overwriting an existing one)

• CVE-2026-33376: fix auth proxy IPv6 allow-list entries without an explicit mask being coerced to /32 instead of /128, which widened the allowed source address range
• CVE-2026-33377: fix privilege escalation where an Editor overwriting an existing dashboard via the import API had default permissions re-applied, granting them Admin on that dashboard; default permissions are now only set for newly created dashboards

These are all security issues fixed in the grafana-11.6.14+security04-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

• Update to version 11.6.14+security-04: Security:

  • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

• CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

• CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

• CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

• CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

• Update to version 11.6.14+security-01: Security:

  • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

• Update to version 11.6.14: Security:

  • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Update to version 11.6.13: Enhancement:

  • Wire the public dashboard service to the HTTP server

• Update to version 11.6.12: Enhancement:

  • Update authentication redirect logic Bug fix:
  • Fix single panel render with variable references

This update fixes the following issues:

dracut-saltboot updated to version 1.2.1:

• Key Update Highlights (v1.2.1)
  • Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option (bsc#1260870)
  • Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s
  • Introduce rd.saltboot namespace for all options, mark old as deprecated

golang-github-QubitProducts-exporter_exporter:

• Security issues fixed:
  • CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter (bsc#1248699)

golang-github-boynux-squid_exporter:

• Non customer facing changes

golang-github-lusitaniae-apache_exporter:

• Non customer facing changes

golang-github-prometheus-alertmanager:

• Non customer facing changes

golang-github-prometheus-node_exporter updated to version 1.10.2:

• Key Update Highlights (v1.10.0 to v1.10.2):
  • New Collectors: Added new collectors for PCIe devices and swaps.
  • New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)
  • Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a logging race condition in systemd.
  • Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.
  • Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)

golang-github-prometheus-prometheus updated to version 3.5.3:

• Security issues fixed:

  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (v3.5.3) (bsc#1263986)
  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit (v3.5.3) (bsc#1263987)
  • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (v3.5.2) (bsc#1262222).
  • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (backported patch) (bsc#1266608)

• Other changes:

  • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)
  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)
  • Internal update with non customer facing changes (v3.5.1)

grafana updated to version 11.6.14+security-04:

• Security issues fixed in v11.6.14+security-04:
  • CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)
• Security issues fixed through backported patches:
  • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  • CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Fixed multiple issues when…

This update fixes the following issues:

Release Notes Highlights:

• Update to SUSE Multi-Linux Manager 5.1.4
  • Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions
  • Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0
  • SUSE Liberty Linux 9.6 Support
  • New API Endpoint - listMigrationTargetsWithChannels
  • Debian 12 End-of-Life Notice
  • SUSE Registry URL Change
  • Security fixes: CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198 CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154 CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380 CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378 CVE-2026-33380, CVE-2026-33381
  • Bugs mentioned: bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107 bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583 bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382 bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474 bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591 bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031 bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327 bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902 bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492 bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814 bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966 bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012 bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174 bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289 bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284 bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534

Container images and uyuni-tools changes:

server-attestation-image:

• Version 5.1.15
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-hub-xmlrpc-api-image:

• Version 5.1.14
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-image:

• Version 5.1.15
  • Healthcheck on disk usage based on taskomatic (bsc#1238890)
  • Added mozilla-nss-sysinit to Dockerfile required for FIPS (bsc#1247707)
  • Do not get repositories from SCC in the server container (bsc#1242916)
  • Added 'susemanager-tools', 'susemanager' and 'susemanager-tools-salt' packages to server-image

server-migration-14-16-image:

• Version 5.1.14
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-postgresql-image:

• Version 5.1.13
  • Healthcheck on disk usage based on taskomatic (bsc#1238890)
  • Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)

server-saline-image:

• Version 5.1.14
  • Use python3*-tornado6 package to make it working with Python 3.11

uyuni-tools:

• Version 5.1.29-0 Check backup status only after database is started (bsc#1262492)
• Version 5.1.28-0
  • Remove waitForTraefik function (bsc#1261902)
  • Fix inspect: missing registry for db image (bsc#1259739)
  • Preserve hub replicas during upgrade (bsc#1262708)
  • Stop automatically unhealthy container
  • Ignore spacewalk-service stop return code.
  • Use correct CA for Report DB (bsc#1260806)
  • Do not call podman healthcheck run to wait for pods to be ready (bsc#1266012)

The following packages are underlying build dependencies and system components used by the containers:

cobbler:

• Added the distro signature for rhel10 (bsc#1265134)

liberate-formula:

• Version 0.1.4
  • No customer facing changes
• Version 0.1.3
  • Liberate formula support for EL10 (bsc#1265975)

prometheus-exporters-formula:

• Version 1.4.3
  • Added support for Python 3.13
  • Drop migrate_formula_data script as it is obsolete

prometheus-postgres_exporter:

-…

This update for grafana fixes the following issues:

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.