RHSA-2026:97215: Important: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) Bug Fix(es) and Enhancement(s): Rebase to grafana 12.4.3 (JIRA:RHEL-171604) [grafana / rhel-10.3] Remove Lua ExclusiveArch macro for Konflux build (JIRA:RHEL-188283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 12.4.3-2.el10 - Upgrade
Upgrade
redhat/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10 - Upgrade
Upgrade
redhat/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10 - Upgrade
Upgrade
redhat/grafana-selinuxto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 12.4.3-2.el10.aa - Upgrade
Upgrade
redhat/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10.aa - Upgrade
Upgrade
redhat/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10.aa - Upgrade
Upgrade
redhat/grafana-selinuxto a version that resolves this vulnerability.Fixed in 12.4.3-2.el10.aa - Upgrade
Upgrade
grafanato a version that resolves this vulnerability.Fixed in 12.4.3 - Configuration
Remove the Lua ExclusiveArch macro for the Konflux build.
grafana / rhel-10.3 Lua ExclusiveArch macro = removed
Event History
Frequently Asked Questions
Which Grafana packages are included in this update?
The update includes redhat/grafana, redhat/grafana-debuginfo, redhat/grafana-debugsource, and redhat/grafana-selinux.
What Grafana version does this update provide?
This update rebases Grafana to version 12.4.3.
Which security issues are addressed?
The update addresses CVE-2026-33810, a certificate-validation bypass involving DNS constraints; CVE-2026-32280, a denial of service in certificate-chain building; and CVE-2026-27136, cross-site scripting through an HTML parsing bypass.