{"id":"CVE-2026-28375","aliases":["ALPINE-CVE-2026-28375","BIT-grafana-2026-28375","CLSA-2026-1785563141","CLSA-2026-1785766306","EUVD-2026-16638","GHSA-mp76-5xhh-vxvc","SUSE-SU-2026:1524-1","SUSE-SU-2026:2243-1","SUSE-SU-2026:2258-1","SUSE-SU-2026:2265-1","UBUNTU-CVE-2026-28375","openSUSE-SU-2026:10601-1","openSUSE-SU-2026:20940-1"],"status":"published","title":"Grafana Testdata datasource can issue unbounded memory allocations","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0039,"percentile":0.33506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-03-27T14:26:19Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"grafana","fixed_in":["12.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.14","12.1.10","12.2.8","12.3.6","12.4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.6.14"},{"fixed":"12.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.6.14"},{"fixed":"12.4.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"8.1.0"},{"fixed":"11.6.14"},{"introduced":"12.0.0"},{"fixed":"12.1.10"},{"introduced":"12.2.0"},{"fixed":"12.2.8"},{"introduced":"12.3.0"},{"fixed":"12.3.6"},{"introduced":"12.4.0"},{"fixed":"12.4.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els15"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els15"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.9-4.el9_2.alma.1.tuxcare.els20"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-150002.4.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-150002.3.9.3"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-bp160.1.1"}]}],"bundled":24}],"products":[{"vendor":"grafana","product":"grafana"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-28375","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28375","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mp76-5xhh-vxvc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-28375","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785563141.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785766306.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28375.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1248707","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262258-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249675","tags":["report"]},{"url":"https://bugzilla.suse.com/1259554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31958","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-28375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28375","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-28375","title":"Grafana Testdata datasource can issue unbounded memory allocations","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T14:26:19.27Z","modified":"2026-08-27T17:22:22.927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-16638","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T14:26:19Z","modified":"2026-08-27T17:22:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-mp76-5xhh-vxvc","title":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T15:30:25Z","modified":"2026-03-31T18:31:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:06:56.438153Z"}],"nvd":[{"id":"CVE-2026-28375","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T15:16:51.547Z","modified":"2026-06-17T13:20:14.5Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-28375","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T15:16:51.547Z","modified":"2026-11-03T06:33:02.161713969Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-28375","title":"Grafana Testdata datasource can issue unbounded memory allocations","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T14:26:19.27Z","modified":"2026-10-28T02:30:47.914862328Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"UBUNTU-CVE-2026-28375","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-03-27T15:16:00Z","modified":"2026-04-02T17:31:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"BIT-grafana-2026-28375","title":"Grafana Testdata datasource can issue unbounded memory allocations","description":"A testdata data-source can be used to trigger out-of-memory crashes in Grafana.","status":"published","published":"2026-04-01T08:41:15.363Z","modified":"2026-09-08T08:47:52.097169042Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1785563141","title":"grafana: Fix of 10 CVEs","description":"- CVE-2026-21722: clamp public dashboard annotation queries to the dashboard's\n  locked time range when time selection is disabled\n- CVE-2026-10601: reject Loki resource paths that escape /loki/api/v1/ and\n  require Tempo trace ids to be hexadecimal\n- CVE-2026-28380: resolve the snapshot's dashboard by uid so the delete\n  permission check is not skipped\n- CVE-2024-10452: require a matching org (or server admin) to revoke an invite\n- CVE-2026-28379: take the read lock around the managed-stream map lookup to\n  stop a fatal concurrent map read/write crash\n- CVE-2026-28376: bound the Live push request body at 500k\n- CVE-2026-28383: bound the plugin resource request body at 128 MiB\n- CVE-2026-28375: cap testdata scenario data points at 10000\n- CVE-2026-27879: bound the mathexp.Resample upsample length","status":"published","published":"2026-08-01T05:45:59Z","modified":"2026-10-26T09:43:48.309543557Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785766306","title":"grafana: Fix of 2 CVEs","description":"- CVE-2026-27879: cap the resampled series length in\n  Series.Resample() at 1,000,000 points; the length was derived\n  straight from the caller-supplied time range and interval and then\n  allocated, so a crafted resample query could exhaust memory\n- CVE-2026-28375: bound the testdata data-source result sizes that\n  were taken unchecked from client-controlled maxDataPoints and line\n  counts - log lines, randomWalkTable, the simulation engine and the\n  USA scenario are each clamped to 10000 points","status":"published","published":"2026-08-03T14:11:58Z","modified":"2026-10-26T09:30:29.100705002Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"openSUSE-SU-2026:10601-1","title":"grafana-11.6.14+security01-1.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-22T00:00:00Z","modified":"2026-04-23T08:45:31.008229Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20940-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14+security-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server’s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14+security-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references\n","status":"published","published":"2026-06-10T12:02:03Z","modified":"2026-06-13T18:24:19.477495413Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n    \ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n    + Bumped rollup to version 4.59.0\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n    + Bumped brace-expansion to version 5.0.2\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    + Bumped google.golang.org/grpc to version 1.79.3\n    \n    \ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n  * CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  * CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:\n    \n  * Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability\n  * Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences\n  * Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: \n    + Fixed bugs involving row repeats and 'self-referencing' data links\n    + Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n\nspacecmd:\n\n- Version 5.1.13-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 5.1.26-0\n  * Fixed applying PTF with images from RPMs (bsc#1252548)\n  * Ssl Key file can miss if CA password is blank (bsc#1254154)\n  * mgrpxy ssh tuning should happens before crypto policies (bsc#1254619)\n  * Fixed default value for helm registry (bsc#1258927).\n  * Remove hub register command\n  * Optimize postgres migration disk space usage (bsc#1257447)\n  * Added continuous database backup support (bsc#1250367)\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  * Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  * Show where final tarball was generated (bsc#1259208)\n  * Set proxy config file permissions (bsc#1257660)\n- Version 5.1.25-0\n  * If PTF image doesn't exists, use the current service image (bsc#1258418)\n\n","status":"published","published":"2026-04-21T09:26:09Z","modified":"2026-04-22T08:15:49.030922Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2243-1","title":"Security update 5.0.8 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security Fixes:\n\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)\n\ngolang-github-prometheus-node_exporter:\n\n- Backward Compatibility and packaging changes:\n  - Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains\n  - Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility\n\n- Version 1.10.2:\n  - Fixed typo in Zswap metric name (meminfo)\n\n- Version 1.10.1:\n  - Fixed mount points being collected multiple times (filesystem)\n  - Refactored mountinfo parsing (bsc#1261810)\n  - Added Zswap/Zswapped metrics (meminfo)\n\n- Version 1.10.0:\n  - New collectors: PCIe devices, swaps\n  - Added systemd virtualization metrics, AIX metrics\n  - WiFi packet metrics, additional PCIe and TLB metrics\n  - Changed mdadm to use sysfs, added erofs to excluded filesystems\n  - Fixed bugs: cpufreq collector, ethtool metrics\n\ngolang-github-prometheus-prometheus:\n    \n- Security issues fixed:\n\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret\n    being exposed in plaintext via /-/config endpoint (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests\n    whose declared decoded length exceeds the decode limit\n    (bsc#1263987).\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label\n    values in old UI heatmap chart tick labels (bsc#1262222)\n  - CVE-2026-33186: Fixed authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    * Bump google.golang.org/grpc to version 1.79.3\n  - CVE-2026-27606: Fixed arbitrary file write via path traversal in\n    rollup (bsc#1258893)\n    * Bump rollup to version 4.59.0\n\n- Other changes:\n\n  - Remote-Write: Reject snappy-compressed requests whose\n    declared decoded length exceeds the decode limit.\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)  \n\n\nprometheus-postgres_exporter:\n\n- Security Fixes:\n\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode\n    limit (bsc#1263987)\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (bsc#1263986)\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)\n\n- Highlights of other changes and bug fixes:\n\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy\n\ngrafana was updated from version 11.6.11 to 11.6.14+security01:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\nspacecmd:\n\n- Version 5.0.16-0:\n\n  - Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n  - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n  - Fixed default value for helm registry (bsc#1258927).\n  - Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  - Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  - Show where final tarball was generated (bsc#1259208)\n\n","status":"published","published":"2026-06-03T14:10:38Z","modified":"2026-06-04T09:00:07.843013639Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2258-1","title":"Security update for grafana","description":"This update for grafana to version to 11.6.14+security01 fixes the following issues:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\n  ","status":"published","published":"2026-06-03T14:22:06Z","modified":"2026-06-04T09:00:04.530372201Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2265-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-06-03T18:02:52Z","modified":"2026-07-13T14:00:33.956635428Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}