{"id":"CVE-2025-12141","aliases":["BIT-grafana-2025-12141","EUVD-2025-209475","GHSA-pcxf-fmpx-32ph","SUSE-SU-2026:3713-1","SUSE-SU-2026:3714-1","SUSE-SU-2026:3718-1","UBUNTU-CVE-2025-12141","openSUSE-SU-2026:11108-1","openSUSE-SU-2026:21351-1"],"status":"published","title":"Grafana Alerting Editors can edit destination of webhooks they did not create","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","severity":{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00255,"percentile":0.17274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-04-15T14:59:41Z","modified":"2026-11-10T17:23:21Z","fixes":[{"ecosystem":"Bitnami","package":"grafana","fixed_in":["12.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["12.4.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150002.3.16.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150002.4.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150000.3.75.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150000.1.98.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150100.4.37.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150200.3.91.1"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana alerting"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-12141/","tags":["Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12141","tags":["web","advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2025-12141"},{"url":"https://github.com/advisories/GHSA-pcxf-fmpx-32ph"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12141.json","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263713-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1265827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269917","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263718-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267153","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-12141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12141","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12141","title":"Grafana Alerting Editors can edit destination of webhooks they did not create","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T14:59:41.317Z","modified":"2026-04-15T18:45:53.672Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-209475","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T14:59:41Z","modified":"2026-04-15T18:45:53Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y","level":"low"}],"updated_at":"2026-11-02T19:24:25.212217Z"}],"ghsa":[{"id":"GHSA-pcxf-fmpx-32ph","title":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the...","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T18:31:56Z","modified":"2026-04-20T21:32:42Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:07:33.597532Z"}],"nvd":[{"id":"CVE-2025-12141","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T16:16:33.04Z","modified":"2026-10-07T09:10:00.16Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:02.090779Z"}],"osv":[{"id":"CVE-2025-12141","title":"Grafana Alerting Editors can edit destination of webhooks they did not create","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T14:59:41.317Z","modified":"2026-10-28T02:31:05.834797391Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"UBUNTU-CVE-2025-12141","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-15T16:16:00Z","modified":"2026-05-14T14:03:36.703364Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"BIT-grafana-2025-12141","title":"Grafana Alerting Editors can edit destination of webhooks they did not create","description":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.","status":"published","published":"2026-04-18T08:40:23.67Z","modified":"2026-09-10T16:00:10.223962655Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2026:11108-1","title":"grafana-12.4.4-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:05.127366707Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21351-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- Add UI web assets as additional source tarball\n\n- Update to version 12.4.5 (jsc#PED-16512):\n  * Datasources: return 400 when payload UID does not match URL UID\n    in PUT /api/datasources/uid/:uid\n\n- Update to version 12.4.4:\n  * Security and quality updates.\n  * Various bug fixes and enhancements.\n\n- Update to version 12.4.3:\n  * Analytics: Keep internal dashboard id.\n  * Go: Update to 1.25.9.\n  * Reporting: Correctly apply appSubURL to report settings\n               requests.\n  * Alerting: Document Grafana HA Alertmanager cluster metrics\n              prefix change.\n\n- Update to version 12.4.2:\n  * Various bug fixes and performance improvements.\n  * Dependency updates to core plugins and UI libraries.\n\n- Update to version 12.4.1:\n  * Bug fixes and minor quality-of-life enhancements.\n  * Updates to data source provisioning and dashboard schemas.\n\n- Update to version 12.4.0:\n  * Introduced dynamic dashboards in public preview.\n  * Added a new side toolbar that replaces the second top toolbar\n    to provide additional vertical space.\n  * Added the ability to create dashboards from templates using\n    sample data.\n  * Revamped the gauge visualization with rounded bars,\n    configurable bar thickness, and endpoint markers.\n  * Added support to map one variable to multiple values.\n  * CVE-2025-12141: Fixed information leakage in Grafana Alerting\n    (bsc#1262187)\n\n- Update to version 12.3.0:\n  * Released a completely redesigned logs visualization.\n  * Added the ability to export dashboards directly as PNG images.\n  * Introduced an interactive learning experience within the\n    Grafana UI.\n  * Added a Switch template variable type to quickly toggle between\n    values in queries.\n  * Added functionality to style table cells using CSS properties\n    via the field cell option.\n\n- Update to version 12.2.0:\n  * Routine feature enhancements, minor bug fixes, and security\n    patches.\n\n- Update to version 12.1.0:\n  * Added support for Entra Workload Identity to enhance\n    authentication capabilities with federated credentials.\n  * Redesigned the alert rule list page.\n  * Renamed Mute Timings to Active Time Intervals in Grafana\n    Alerting.\n  * Added support for Service Account Impersonation in the BigQuery\n    data source.\n  * Introduced the Grafana Advisor in public preview.\n\n- Update to version 12.0.0:\n  * BREAKING: Removed AngularJS and all deprecated UI Extensions\n    APIs.\n  * BREAKING: Enforced stricter version compatibility checks in\n    plugin CLI install commands.\n  * BREAKING: Enabled the failWrongDSUID feature flag by default,\n    which rejects data sources with incorrect UIDs.\n  * MIGRATION: Triggered a full-table rewrite for the annotation\n    table, which may temporarily increase disk usage.\n  * Introduced a new dashboard schema to replace the original\n    single grid layout.\n\n- CVE-2026-41607: Fix potential information disclosure in Apache\n  Thrift (bsc#1263272)\n","status":"published","published":"2026-07-14T09:22:23Z","modified":"2026-07-15T10:00:12.751955097Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:3713-1","title":"Security update for Multi-Linux Manager Client Tools - Monitoring stack","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:\n    \n- Security fixes:\n\n  - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n  - CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n  - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n  - CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)\n    \n- Other bugs fixed and changes:\n\n   * STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint\n   * Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:53:30Z","modified":"2026-08-24T17:30:04.93156196Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3714-1","title":"Security update for Multi-Linux Manager Monitoring stack","description":"This update fixes the following issues:\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass \n  and privilege escalation (bsc#1248699)\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version 0.55.0 (bsc#1266615)\n\ngolang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:\n\nSecurity fixes:\n\n- CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)\n- CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)\n- CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)\n- CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)\n\nOther changes and fixes:\n    \n- STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint\n- Chore: Bump golang.org/x/net to version 0.55.0\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T02:55:28Z","modified":"2026-11-10T17:23:21.319856144Z","updated_at":"2026-11-10T17:35:04.393608Z"},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T09:23:40Z","modified":"2026-08-26T18:23:35.632543325Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}