Every CVE Search/ Get API key

CVE-2026-27877

Public dashboards discloses all direct mode datasources

6.5 MediumFix available

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Mar 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
CVE-2026-27877
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312, CWE-201
Updated
2026-11-02
EUVDEUVD-2026-16596 7.5

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
EUVD-2026-16596
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3q27-7qjq-p9c5 6.5

Grafana public dashboards disclose all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
GHSA-3q27-7qjq-p9c5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-312
Updated
2026-11-02
NVD 6.5

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
CVE-2026-27877
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312, CWE-201
Updated
2026-11-02
OSVALPINE-CVE-2026-27877 7.5

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
ALPINE-CVE-2026-27877
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSV 6.5

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
CVE-2026-27877
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 27 moreShow less
OSVGHSA-3q27-7qjq-p9c5 6.5

Grafana public dashboards disclose all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
GHSA-3q27-7qjq-p9c5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-312
Updated
2026-11-02
OSVRHSA-2026:10223 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:10223
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:10226 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:10226
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11416 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:11416
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11417 7.5

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:11417
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:19134 7.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:19134
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19352 7.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:19352
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:10223 7.5

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:10223
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:10226 7.5

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:10226
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:19134 7.8

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19134
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19352 7.8

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19352
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27877 6.5

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
UBUNTU-CVE-2026-27877
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:10223 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:10223
Updated
2026-11-02
OSVALSA-2026:10226 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:10226
Updated
2026-11-02
OSVALSA-2026:19134 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)
  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19134
Updated
2026-11-02
OSVALSA-2026:19352 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)
  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19352
Updated
2026-11-02
OSVBIT-grafana-2026-27877 No score

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Record
BIT-grafana-2026-27877
Updated
2026-11-02
OSVCLSA-2026-1777944610 No score

grafana: Fix of CVE-2026-27877

  • CVE-2026-27877: fix exposure of direct data-source passwords via public dashboards by limiting frontend settings to data sources actually used by the dashboard
  • Note: upstream test additions in pkg/api/frontendsettings_test.go are not backported. The %check stage only runs the Jest frontend suite (gated on 0), so backend Go tests would not be exercised by this build, and the upstream test depends on hs.publicDashboardsService which does not exist in 10.2.6 (the production fix already uses the hs.PublicDashboardsApi.PublicDashboardService adapter for the same reason)
Record
CLSA-2026-1777944610
Updated
2026-11-02
OSVCLSA-2026-1792076604 No score

grafana: Fix of CVE-2026-27877

  • CVE-2026-27877: fix public dashboards showing "No data": the data source filter added in els7 dropped every data source the dashboard uses, because DsLookup.ByRef returned nothing for references it does not know; return the original reference instead
Record
CLSA-2026-1792076604
Updated
2026-11-02
OSVGO-2026-5095 No score

Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana

Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v1.9.2-0.20221116104934-4ee83a5f2bf4 before v1.9.2-0.20260325055210-3522153e07b4.

Record
GO-2026-5095
Updated
2026-11-02
OSVopenSUSE-SU-2026:10601-1 No score

grafana-11.6.14+security01-1.1 on GA media

These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20940-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

  • Update to version 11.6.14+security-04: Security:

    • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
    • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
    • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
    • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
    • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
    • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
    • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
    • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
    • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
    • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

  • CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

  • CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

  • CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

  • CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

  • Update to version 11.6.14+security-01: Security:

    • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

  • Update to version 11.6.14: Security:

    • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Update to version 11.6.13: Enhancement:

    • Wire the public dashboard service to the HTTP server

  • Update to version 11.6.12: Enhancement:

    • Update authentication redirect logic Bug fix:
    • Fix single panel render with variable references
Record
openSUSE-SU-2026:20940-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:1524-1 No score

Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

  • Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bumped rollup to version 4.59.0
    • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
      • Bumped brace-expansion to version 5.0.2
    • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
    • CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bumped google.golang.org/grpc to version 1.79.3

grafana:

  • Security issues fixed:

    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
    • CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
    • CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
    • CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)
    • CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:

    • Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability
    • Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences
    • Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced
    • Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface
    • One-Click Actions: Visualizations now support faster navigation via one-click links and actions
    • Alerting History: Added version history for alert rules, allowing you to track changes over time
    • Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
    • Cron Support: Annotations now support Cron syntax for more flexible scheduling
    • Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath
    • Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting
    • Alerting Limits: Added size limits for expanded notification templates to prevent system strain
    • RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
    • Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries
    • Dashboard Reliability:
      • Fixed bugs involving row repeats and 'self-referencing' data links
      • Fixed a bug preventing single panels from…
Record
SUSE-SU-2026:1524-1
Updated
2026-11-02
OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Security Fixes:

    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

  • Backward Compatibility and packaging changes:

    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

  • Version 1.10.2:

    • Fixed typo in Zswap metric name (meminfo)

  • Version 1.10.1:

    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)

  • Version 1.10.0:

    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bump google.golang.org/grpc to version 1.79.3
    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bump rollup to version 4.59.0

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

  • Security Fixes:

    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

  • Highlights of other changes and bug fixes:

    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references

spacecmd:

  • Version…
Record
SUSE-SU-2026:2243-1
Updated
2026-11-02
OSVSUSE-SU-2026:2258-1 No score

Security update for grafana

This update for grafana to version to 11.6.14+security01 fixes the following issues:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references
Record
SUSE-SU-2026:2258-1
Updated
2026-11-02
OSVSUSE-SU-2026:2265-1 No score

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update

Record
SUSE-SU-2026:2265-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 9.3.0 up to 11.6.14
11.6.14
github.com/grafana/grafana
Go
 12.0.0 up to 12.1.10
12.1.10
github.com/grafana/grafana
Go
 12.2.0 up to 12.2.8
12.2.8
github.com/grafana/grafana
Go
 12.3.0 up to 12.3.6
12.3.6
github.com/grafana/grafana
Go
 12.4.0 up to 12.4.2
12.4.2
github.com/grafana/grafana
Go
 1.9.2-0.20221116104934-4ee83a5f2bf4 up to 1.9.2-0.20260325055210-3522153e07b4
1.9.2-0.20260325055210-3522153e07b4
grafana
Alpine:v3.23
 11.6.14 up to 12.2.8-r0
12.2.8-r0
grafana
Alpine:v3.24
 11.6.14 up to 12.4.3-r0
12.4.3-r0
grafana
AlmaLinux:10
 before 10.2.6-24.el10_1
10.2.6-24.el10_1
grafana-selinux
AlmaLinux:10
 before 10.2.6-24.el10_1
10.2.6-24.el10_1
Show 57 moreShow less
Affected packages
PackageAffectedFixed
grafana
AlmaLinux:9
 before 10.2.6-20.el9_7
10.2.6-20.el9_7
grafana-selinux
AlmaLinux:9
 before 10.2.6-20.el9_7
10.2.6-20.el9_7
grafana
AlmaLinux:10
 before 10.2.6-26.el10_2
10.2.6-26.el10_2
grafana-selinux
AlmaLinux:10
 before 10.2.6-26.el10_2
10.2.6-26.el10_2
grafana
AlmaLinux:9
 before 10.2.6-22.el9_8
10.2.6-22.el9_8
grafana-selinux
AlmaLinux:9
 before 10.2.6-22.el9_8
10.2.6-22.el9_8
grafana
Bitnami
 9.3.0 up to 11.6.14, 12.0.0 up to 12.1.10, 12.2.0 up to 12.2.8, 12.3.0 up to 12.3.6, 12.4.0 up to 12.4.2
11.6.1412.1.1012.2.812.3.612.4.2
grafana
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els7
10.2.6-15.el9_6.tuxcare.els7
grafana-selinux
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els7
10.2.6-15.el9_6.tuxcare.els7
grafana
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els20
10.2.6-15.el9_6.tuxcare.els20
grafana-selinux
TuxCare:AlmaLinux:9.6
 before 10.2.6-15.el9_6.tuxcare.els20
10.2.6-15.el9_6.tuxcare.els20
github.com/grafana/grafana
Go
 9.3.0 and later None known
github.com/grafana/grafana
Go
 12.0.0 and later None known
github.com/grafana/grafana
Go
 12.2.0 and later None known
github.com/grafana/grafana
Go
 12.3.0 and later None known
github.com/grafana/grafana
Go
 12.4.0 and later None known
github.com/grafana/grafana
Go
 All versions None known
grafana
Red Hat:enterprise_linux:10.1
 before 0:10.2.6-24.el10_1
0:10.2.6-24.el10_1
grafana-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:10.2.6-24.el10_1
0:10.2.6-24.el10_1
grafana-debugsource
Red Hat:enterprise_linux:10.1
 before 0:10.2.6-24.el10_1
0:10.2.6-24.el10_1
grafana-selinux
Red Hat:enterprise_linux:10.1
 before 0:10.2.6-24.el10_1
0:10.2.6-24.el10_1
grafana
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-20.el9_7
0:10.2.6-20.el9_7
grafana-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-20.el9_7
0:10.2.6-20.el9_7
grafana-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-20.el9_7
0:10.2.6-20.el9_7
grafana-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-20.el9_7
0:10.2.6-20.el9_7
grafana
Red Hat:rhel_eus:9.6::appstream
 before 0:10.2.6-20.el9_6
0:10.2.6-20.el9_6
grafana-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:10.2.6-20.el9_6
0:10.2.6-20.el9_6
grafana-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:10.2.6-20.el9_6
0:10.2.6-20.el9_6
grafana-selinux
Red Hat:rhel_eus:9.6::appstream
 before 0:10.2.6-20.el9_6
0:10.2.6-20.el9_6
grafana
Red Hat:enterprise_linux_eus:10.0
 before 0:10.2.6-23.el10_0
0:10.2.6-23.el10_0
grafana-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:10.2.6-23.el10_0
0:10.2.6-23.el10_0
grafana-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:10.2.6-23.el10_0
0:10.2.6-23.el10_0
grafana-selinux
Red Hat:enterprise_linux_eus:10.0
 before 0:10.2.6-23.el10_0
0:10.2.6-23.el10_0
grafana
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-26.el10_2
0:10.2.6-26.el10_2
grafana-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-26.el10_2
0:10.2.6-26.el10_2
grafana-debugsource
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-26.el10_2
0:10.2.6-26.el10_2
grafana-selinux
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-26.el10_2
0:10.2.6-26.el10_2
grafana
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-22.el9_8
0:10.2.6-22.el9_8
grafana-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-22.el9_8
0:10.2.6-22.el9_8
grafana-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-22.el9_8
0:10.2.6-22.el9_8
grafana-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-22.el9_8
0:10.2.6-22.el9_8
grafana
Rocky Linux:10
 before 0:10.2.6-24.el10_1
0:10.2.6-24.el10_1
grafana
Rocky Linux:9
 before 0:10.2.6-20.el9_7
0:10.2.6-20.el9_7
grafana
Rocky Linux:10
 before 0:10.2.6-26.el10_2
0:10.2.6-26.el10_2
grafana
Rocky Linux:9
 before 0:10.2.6-22.el9_8
0:10.2.6-22.el9_8
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 1.0.10-150002.3.6.1
1.0.10-150002.3.6.1
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
 before 3.5.0-150002.3.8.1
3.5.0-150002.3.8.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
 before 11.6.14+security01-150002.4.14.1
11.6.14+security01-150002.4.14.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
 before 5.1.13-150002.3.9.3
5.1.13-150002.3.9.3
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
grafana
openSUSE:Tumbleweed
 before 11.6.14+security01-1.1
11.6.14+security01-1.1
grafana
openSUSE:Leap 16.0
 before 11.6.14+security04-bp160.1.1
11.6.14+security04-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27877 is a medium vulnerability (CVSS 6.5) in Grafana, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in github.com/grafana/grafana 11.6.14.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,671 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open