CVE-2026-27879

A resample query can be used to trigger out-of-memory crashes in Grafana.

A resample query can be used to trigger out-of-memory crashes in Grafana.

• CVE-2026-21722: clamp public dashboard annotation queries to the dashboard's locked time range when time selection is disabled
• CVE-2026-10601: reject Loki resource paths that escape /loki/api/v1/ and require Tempo trace ids to be hexadecimal
• CVE-2026-28380: resolve the snapshot's dashboard by uid so the delete permission check is not skipped
• CVE-2024-10452: require a matching org (or server admin) to revoke an invite
• CVE-2026-28379: take the read lock around the managed-stream map lookup to stop a fatal concurrent map read/write crash
• CVE-2026-28376: bound the Live push request body at 500k
• CVE-2026-28383: bound the plugin resource request body at 128 MiB
• CVE-2026-28375: cap testdata scenario data points at 10000
• CVE-2026-27879: bound the mathexp.Resample upsample length

• CVE-2026-27879: cap the resampled series length in Series.Resample() at 1,000,000 points; the length was derived straight from the caller-supplied time range and interval and then allocated, so a crafted resample query could exhaust memory
• CVE-2026-28375: bound the testdata data-source result sizes that were taken unchecked from client-controlled maxDataPoints and line counts - log lines, randomWalkTable, the simulation engine and the USA scenario are each clamped to 10000 points

These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

• Update to version 11.6.14+security-04: Security:

  • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

• CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

• CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

• CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

• CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

• Update to version 11.6.14+security-01: Security:

  • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

• Update to version 11.6.14: Security:

  • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Update to version 11.6.13: Enhancement:

  • Wire the public dashboard service to the HTTP server

• Update to version 11.6.12: Enhancement:

  • Update authentication redirect logic Bug fix:
  • Fix single panel render with variable references

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • Bumped rollup to version 4.59.0
  • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
    • Bumped brace-expansion to version 5.0.2
  • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
  • CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
    • Bumped google.golang.org/grpc to version 1.79.3

grafana:

• Security issues fixed:

  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
  • CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
  • CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
  • CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)
  • CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:

  • Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability
  • Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences
  • Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced
  • Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface
  • One-Click Actions: Visualizations now support faster navigation via one-click links and actions
  • Alerting History: Added version history for alert rules, allowing you to track changes over time
  • Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
  • Cron Support: Annotations now support Cron syntax for more flexible scheduling
  • Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath
  • Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting
  • Alerting Limits: Added size limits for expanded notification templates to prevent system strain
  • RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
  • Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries
  • Dashboard Reliability:
    • Fixed bugs involving row repeats and 'self-referencing' data links
    • Fixed a bug preventing single panels from…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Security Fixes:

  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

• Backward Compatibility and packaging changes:

  • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
  • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

• Version 1.10.2:

  • Fixed typo in Zswap metric name (meminfo)

• Version 1.10.1:

  • Fixed mount points being collected multiple times (filesystem)
  • Refactored mountinfo parsing (bsc#1261810)
  • Added Zswap/Zswapped metrics (meminfo)

• Version 1.10.0:

  • New collectors: PCIe devices, swaps
  • Added systemd virtualization metrics, AIX metrics
  • WiFi packet metrics, additional PCIe and TLB metrics
  • Changed mdadm to use sysfs, added erofs to excluded filesystems
  • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
  • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
    • Bump google.golang.org/grpc to version 1.79.3
  • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • Bump rollup to version 4.59.0

• Other changes:

  • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

• Security Fixes:

  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

• Highlights of other changes and bug fixes:

  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

spacecmd:

• Version…

This update for grafana to version to 11.6.14+security01 fixes the following issues:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update