CVE-2026-33382

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

• grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

• grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

• [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
• grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)
• grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)
• grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

• [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

• CVE-2026-33382: cap JSON bodies read by web.Bind at 100 MiB and pre-auth login, signup, password reset and invite bodies at 100 KiB

These are all security issues fixed in the grafana-12.4.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:

• Security fixes:

  • CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
  • CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
  • CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
  • CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)

• Other bugs fixed and changes:

  • STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint
  • Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update fixes the following issues:

prometheus-postgres_exporter:

• CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass and privilege escalation (bsc#1248699)

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

Security fixes:

• CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
• CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
• CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
• CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)

Other changes and fixes:

• STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint
• Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update for grafana fixes the following issues:

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.