RLSA-2026:98056: Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)
grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)
grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)
grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 0:12.4.3-3.el10_3.2 - Upgrade
Upgrade
rocky-linux/grafana-selinuxto a version that resolves this vulnerability.Fixed in 0:12.4.3-3.el10_3.2 - Upgrade
Upgrade
rocky-linux/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 0:12.4.3-3.el10_3.2 - Upgrade
Upgrade
rocky-linux/grafanato a version that resolves this vulnerability.Fixed in 0:12.4.3-3.el10_3.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most exposed to unauthorized access through the Auth Proxy issue?
Grafana deployments using Auth Proxy are relevant to CVE-2026-33376. The issue involves an incorrect IPv6 allow-list default; the provided advisory does not state which specific configurations are affected beyond Auth Proxy use.
What level of access does an attacker need for the privilege-escalation issue?
The supplied CVSS vector for the advisory indicates network reachability, low attack complexity, low privileges required, and no user interaction. It also indicates high impact to confidentiality, integrity, and availability.
What service-impact risks are included in this update?
The update includes denial-of-service fixes involving Grafana OAuth login handling and large API request payloads, as well as Go component issues involving ASN.1 parsing, URL path resolution, unencrypted HTTP/2 connections, TLS KeyUpdate messages, and XML decoding.
Which Rocky Linux packages are covered by this advisory?
The advisory lists rocky-linux/grafana, rocky-linux/grafana-debuginfo, rocky-linux/grafana-debugsource, and rocky-linux/grafana-selinux.