RLSA-2026:97215: Important: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
Bug Fix(es) and Enhancement(s):
Rebase to grafana 12.4.3 (JIRA:Rocky Linux-171604)
[grafana / rhel-10.3] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafana-selinuxto a version that resolves this vulnerability.Fixed in 0:12.4.3-2.el10 - Upgrade
Upgrade
rocky-linux/grafanato a version that resolves this vulnerability.Fixed in 0:12.4.3-2.el10 - Upgrade
Upgrade
rocky-linux/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 0:12.4.3-2.el10 - Upgrade
Upgrade
rocky-linux/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 0:12.4.3-2.el10 - Upgrade
Upgrade
grafanato a version that resolves this vulnerability.Fixed in 12.4.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux packages are included in this update?
The update includes grafana, grafana-selinux, grafana-debuginfo, and grafana-debugsource packages.
What Grafana version does this update provide?
The update rebases Grafana to version 12.4.3.
What does the supplied severity vector indicate about exploitation requirements?
The vector indicates network-based exploitation with low attack complexity and no required attacker privileges, but user interaction is required. It also indicates changed scope and high confidentiality impact, with low integrity and availability impact.