CVE-2026-33375

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

• Update to version 11.6.14+security-04: Security:

  • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

• CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

• CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

• CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

• CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

• Update to version 11.6.14+security-01: Security:

  • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

• Update to version 11.6.14: Security:

  • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Update to version 11.6.13: Enhancement:

  • Wire the public dashboard service to the HTTP server

• Update to version 11.6.12: Enhancement:

  • Update authentication redirect logic Bug fix:
  • Fix single panel render with variable references

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Security Fixes:

  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

• Backward Compatibility and packaging changes:

  • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
  • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

• Version 1.10.2:

  • Fixed typo in Zswap metric name (meminfo)

• Version 1.10.1:

  • Fixed mount points being collected multiple times (filesystem)
  • Refactored mountinfo parsing (bsc#1261810)
  • Added Zswap/Zswapped metrics (meminfo)

• Version 1.10.0:

  • New collectors: PCIe devices, swaps
  • Added systemd virtualization metrics, AIX metrics
  • WiFi packet metrics, additional PCIe and TLB metrics
  • Changed mdadm to use sysfs, added erofs to excluded filesystems
  • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
  • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
    • Bump google.golang.org/grpc to version 1.79.3
  • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • Bump rollup to version 4.59.0

• Other changes:

  • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

• Security Fixes:

  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

• Highlights of other changes and bug fixes:

  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

spacecmd:

• Version…

This update for grafana to version to 11.6.14+security01 fixes the following issues:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:

This is a codestream only update