ALSA-2026:99030: Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/grafanato a version that resolves this vulnerability.Fixed in 9.2.10-38.el8_10 - Upgrade
Upgrade
almalinux/grafana-selinuxto a version that resolves this vulnerability.Fixed in 9.2.10-38.el8_10
Event History
Frequently Asked Questions
Which installed packages are covered by this update?
The advisory covers the AlmaLinux grafana and grafana-selinux packages.
What types of security impact are addressed?
The update addresses an information-disclosure issue in Grafana Unified Alerting (CVE-2026-17183) and a denial-of-service issue involving crafted zstd compressed input in github.com/klauspost/compress/zstd (CVE-2026-116591).
When was this advisory published?
It was published on 2026-11-11 and modified on 2026-11-13.