ALSA-2026:89732: Important: grafana security update

Q: Which components should be reviewed for this update?

The advisory lists the AlmaLinux grafana and grafana-selinux packages. Systems using Grafana should review both packages when applying the update.

Q: What types of impact are addressed?

The update addresses an information disclosure issue in Grafana Unified Alerting (CVE-2026-17183) and a denial-of-service issue involving Go multipart form parsing and a memory-limit bypass (CVE-2026-94440).

Q: Is there enough information to determine whether a particular Grafana deployment is affected by default?

No. The advisory does not provide affected version ranges, configuration prerequisites, or default-exposure details. Review the referenced CVE information and compare installed package versions with the vendor-provided update.

Published Oct 26, 2026

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

2 affected componentsFixes available

almalinux/grafana<10.2.6-28.el10_2.9

10.2.6-28.el10_2.9

almalinux/grafana-selinux<10.2.6-28.el10_2.9

10.2.6-28.el10_2.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/grafana to a version that resolves this vulnerability.
Fixed in 10.2.6-28.el10_2.9
Upgrade
Upgrade almalinux/grafana-selinux to a version that resolves this vulnerability.
Fixed in 10.2.6-28.el10_2.9

Event History

Oct 26, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Which components should be reviewed for this update?

The advisory lists the AlmaLinux grafana and grafana-selinux packages. Systems using Grafana should review both packages when applying the update.

What types of impact are addressed?

The update addresses an information disclosure issue in Grafana Unified Alerting (CVE-2026-17183) and a denial-of-service issue involving Go multipart form parsing and a memory-limit bypass (CVE-2026-94440).

Is there enough information to determine whether a particular Grafana deployment is affected by default?

No. The advisory does not provide affected version ranges, configuration prerequisites, or default-exposure details. Review the referenced CVE information and compare installed package versions with the vendor-provided update.

ALSA-2026:89732: Important: grafana security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which components should be reviewed for this update?

What types of impact are addressed?

Is there enough information to determine whether a particular Grafana deployment is affected by default?

Company

Resources

Contact

Frequently Asked Questions

Which components should be reviewed for this update?

What types of impact are addressed?

Is there enough information to determine whether a particular Grafana deployment is affected by default?