RHSA-2026:99151: Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967) github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10 - Upgrade
Upgrade
redhat/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10 - Upgrade
Upgrade
redhat/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10 - Upgrade
Upgrade
redhat/grafana-selinuxto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10.aa - Upgrade
Upgrade
redhat/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10.aa - Upgrade
Upgrade
redhat/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10.aa - Upgrade
Upgrade
redhat/grafana-selinuxto a version that resolves this vulnerability.Fixed in 10.2.6-23.el9_8.10.aa
Event History
Frequently Asked Questions
Which component is affected by the access-token exposure issue?
The issue affects Grafana's Azure Monitor data source, which could leak its Azure access token. Deployments that use this data source are the directly relevant exposure group.
What kind of input is involved in the denial-of-service issue?
The denial-of-service issue is triggered by crafted zstd-compressed input in github.com/klauspost/compress/zstd. The provided advisory data does not specify the affected request path, configuration, or workaround.
Which Red Hat packages are covered by this update?
The update covers redhat/grafana, redhat/grafana-debuginfo, redhat/grafana-debugsource, and redhat/grafana-selinux.