Every CVE Search/ Get API key

CVE-2026-17183

CVE-2026-17183 CVE Record

7.1 HighFix available

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.29%Down 0.1 points since Aug 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
CVE-2026-17183
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-62597 7.1

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
EUVD-2026-62597
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f74r-h7qj-c63f 7.1

Summary An authenticated organization user who can create or edit alert rules in a folder can...

Summary

An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to expr while retaining the UID of a real datasource.

The alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid.

Impact

This bypass can expose data accessible through Grafana's configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High.

Integrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated.

Attack prerequisites

  • Authenticated, low-privileged user in the same Grafana organization
  • Permission to create or edit alert rules in an accessible folder
  • No datasources:query permission for the targeted datasource
  • Knowledge or discovery of the targeted datasource UID
  • No user interaction required

Technical details / root cause

  1. The attacker submits an alert-rule query with queryType: "expr" and the UID of a real datasource.
  2. The datasource authorization helper skips permission enforcement when query.QueryType == "expr".
  3. queryType is client-controlled and is not validated against the referenced datasource.
  4. During evaluation, Grafana selects and loads the actual datasource using DatasourceUID, not the spoofed queryType.
  5. The query therefore executes using Grafana's datasource credentials despite the caller lacking datasources:query.

The root cause is inconsistent query classification between authorization and execution: authorization trusts queryType, while execution trusts DatasourceUID.

Affected product / component

  • Product: Grafana OSS
  • Component: Unified Alerting / ngalert
  • Area: Alert-rule datasource authorization and query evaluation
  • Confirmed version: Grafana OSS 13.0.1
  • Affected version range: not yet assessed

Severity

  • CVSS 3.1: 7.1 High
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
  • CWE-863: Incorrect Authorization

Scope is Unchanged because the vulnerable authorization decision and resulting impact remain within Grafana's security authority.

Source

Related report / duplicate assessment

This is a default-Grafana-OSS reproduction of the root cause previously reported in GRAFANALABS-IAQAFIXI. The earlier submission was archived as Not Applicable because its proof of concept depended on Cloud/Enterprise-specific permission mechanisms, and the researcher was invited to demonstrate the issue under default OSS permissions. This report establishes that missing prerequisite and should be treated as the actionable OSS submission, not dismissed as a duplicate.

VUL-2026-0095 and VUL-2026-0126 concern Enterprise Recorded Queries and have different components, endpoints, and root causes; they are related authorization issues but not duplicates.

Recommended remediation

  • Do not exempt a query from datasource authorization based solely on client-controlled queryType.
  • Resolve the referenced datasource server-side before authorization and apply datasources:query whenever the resolved UID represents a real datasource.
  • Require expression queries to reference only the canonical server-side expression datasource and reject mismatches such as queryType: "expr" paired with a real datasource UID.
  • Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.
  • Add regression coverage for an OSS user with folder-level alert-rule edit permission but…
Record
GHSA-f74r-h7qj-c63f
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 7.1

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
CVE-2026-17183
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2026-17183 7.1

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
ALPINE-CVE-2026-17183
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-04
OSVRHSA-2026:65157 8.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:65157
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
Show 12 moreShow less
OSVRHSA-2026:65537 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:65537
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66449 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:66449
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:89732 7.5

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

  • net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89732
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:89744 7.5

Critical: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)

  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89744
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-17183 7.1

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
UBUNTU-CVE-2026-17183
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:89732 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
  • net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89732
Updated
2026-11-02
OSVALSA-2026:89744 No score

Critical: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89744
Updated
2026-11-02
OSVBIT-grafana-2026-17183 No score

CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Record
BIT-grafana-2026-17183
Updated
2026-11-02
OSVopenSUSE-SU-2026:11684-1 No score

grafana-12.4.10-1.1 on GA media

These are all security issues fixed in the grafana-12.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11684-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22125-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

  • Security:

    • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
    • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
    • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
    • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
    • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
    • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

  • Bug fixes:

    • Dashboards: Fix adhoc and groupby variable datasource on UI import
    • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

  • Features and enhancements:

    • Dashboard Import: Labels in v2 schema

  • Bug fixes:

    • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

  • Security:

    • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

  • Security:

    • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

  • Features and enhancements:

    • Dashboards: Get annotations and dashboard endpoint performance improvements

  • Bug fixes:

    • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

  • Security:

    • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

  • Features and enhancements:

    • Alerting: Add protected fields authorization check to provisioning API
    • Alerting: Return 403 instead of 500 on contact point provenance mismatch

  • Bug fixes:

    • Jaeger: Handle gzip, deflate, and brotli compressed API responses
    • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

  • CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

  • CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

  • CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

  • CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

  • CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

  • CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Record
openSUSE-SU-2026:22125-1
Updated
2026-11-02
OSVSUSE-SU-2026:4585-1 No score

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

  • Security issues:

    • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
    • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
    • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…
Record
SUSE-SU-2026:4585-1
Updated
2026-11-02
OSVSUSE-SU-2026:4600-1 No score

Security update for grafana, system-user-grafana

This update for grafana, system-user-grafana fixes the following issues:

  • Update to version 12.4.10:

    • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
    • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

  • Update to version 12.4.9:

    • Features and enhancements: Dashboard Import: Labels in v2 schema
    • Bug fixes: Azure Monitor: fix migration for dimension filters

  • Update to version 12.4.8:

    • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

  • Update to version 12.4.7:

    • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
    • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
    • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

  • Update to version 12.4.6:

    • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
    • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
    • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

  • Drop 0005-Bump-edwards25519.patch

    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

    • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
    • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

  • CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

  • Build only for SUSE distributions

Record
SUSE-SU-2026:4600-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grafana
Alpine:v3.24
 before 12.4.14-r0
12.4.14-r0
grafana
AlmaLinux:10
 before 10.2.6-28.el10_2.9
10.2.6-28.el10_2.9
grafana-selinux
AlmaLinux:10
 before 10.2.6-28.el10_2.9
10.2.6-28.el10_2.9
grafana
AlmaLinux:9
 before 10.2.6-23.el9_8.7
10.2.6-23.el9_8.7
grafana-selinux
AlmaLinux:9
 before 10.2.6-23.el9_8.7
10.2.6-23.el9_8.7
grafana
Bitnami
 8.4.0 up to 12.3.11, 12.4.0 up to 12.4.9, 13.0.0 up to 13.0.7, 13.1.0 up to 13.1.4
12.3.1112.4.913.0.713.1.4
grafana12.4
Red Hat:hummingbird:1
 before 0:12.4.10-0.1.hum1
0:12.4.10-0.1.hum1
grafana13.2
Red Hat:hummingbird:1
 before 0:13.2.1-0.2.hum1
0:13.2.1-0.2.hum1
grafana13.1
Red Hat:hummingbird:1
 before 0:13.1.3-0.7.hum1
0:13.1.3-0.7.hum1
grafana
Rocky Linux:10
 before 0:10.2.6-28.el10_2.9
0:10.2.6-28.el10_2.9
Show 15 moreShow less
Affected packages
PackageAffectedFixed
grafana
Rocky Linux:9
 before 0:10.2.6-23.el9_8.7
0:10.2.6-23.el9_8.7
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
 before 3.13.2-150002.3.19.1
3.13.2-150002.3.19.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
 before 12.4.10-150002.4.27.1
12.4.10-150002.4.27.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.5-150002.3.12.1
5.2.5-150002.3.12.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.10-150002.3.15.1
5.2.10-150002.3.15.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.7-150002.3.12.1
5.2.7-150002.3.12.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-15
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 12.4.10-150200.3.94.3
12.4.10-150200.3.94.3
system-user-grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 1.0.0-150200.5.8.1
1.0.0-150200.5.8.1
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
grafana
openSUSE:Tumbleweed
 before 12.4.10-1.1
12.4.10-1.1
grafana
openSUSE:Leap 16.0
 before 12.4.10-bp160.1.1
12.4.10-bp160.1.1

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-17183 is a high vulnerability (CVSS 7.1) in Grafana Enterprise, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in grafana 12.4.14-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 18 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open