RLSA-2026:98541: Important: grafana security update

Q: Which Rocky Linux packages are covered by this update?

The advisory covers rocky-linux/grafana and its related grafana-debuginfo, grafana-debugsource, and grafana-selinux packages.

Q: Which Grafana deployments should be prioritized for remediation?

Prioritize Grafana instances using the Azure Monitor data source, because the update addresses a potential leak of its Azure access token. Instances that process zstd-compressed input should also be considered, due to the crafted-input denial-of-service issue in klauspost/compress/zstd.

Q: Does the published severity information indicate that authentication or user interaction is required?

The published CVSS vector lists PR:N and UI:N, indicating no privileges or user interaction are required, while AC:H indicates high attack complexity. The advisory assigns an overall high severity score of 7.7.

Published Nov 13, 2026

Updated

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

4 affected componentsFixes available

rocky-linux/grafana<0:10.2.6-24.el9_9.8

0:10.2.6-24.el9_9.8

rocky-linux/grafana-debuginfo<0:10.2.6-24.el9_9.8

0:10.2.6-24.el9_9.8

rocky-linux/grafana-debugsource<0:10.2.6-24.el9_9.8

0:10.2.6-24.el9_9.8

rocky-linux/grafana-selinux<0:10.2.6-24.el9_9.8

0:10.2.6-24.el9_9.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/grafana to a version that resolves this vulnerability.
Fixed in 0:10.2.6-24.el9_9.8
Upgrade
Upgrade rocky-linux/grafana-debuginfo to a version that resolves this vulnerability.
Fixed in 0:10.2.6-24.el9_9.8
Upgrade
Upgrade rocky-linux/grafana-debugsource to a version that resolves this vulnerability.
Fixed in 0:10.2.6-24.el9_9.8
Upgrade
Upgrade rocky-linux/grafana-selinux to a version that resolves this vulnerability.
Fixed in 0:10.2.6-24.el9_9.8

Event History

Nov 13, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Rocky Linux packages are covered by this update?

The advisory covers rocky-linux/grafana and its related grafana-debuginfo, grafana-debugsource, and grafana-selinux packages.

Which Grafana deployments should be prioritized for remediation?

Prioritize Grafana instances using the Azure Monitor data source, because the update addresses a potential leak of its Azure access token. Instances that process zstd-compressed input should also be considered, due to the crafted-input denial-of-service issue in klauspost/compress/zstd.

Does the published severity information indicate that authentication or user interaction is required?

The published CVSS vector lists PR:N and UI:N, indicating no privileges or user interaction are required, while AC:H indicates high attack complexity. The advisory assigns an overall high severity score of 7.7.

RLSA-2026:98541: Important: grafana security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Rocky Linux packages are covered by this update?

Which Grafana deployments should be prioritized for remediation?

Does the published severity information indicate that authentication or user interaction is required?

Company

Resources

Contact

Frequently Asked Questions

Which Rocky Linux packages are covered by this update?

Which Grafana deployments should be prioritized for remediation?

Does the published severity information indicate that authentication or user interaction is required?