RLSA-2026:99030: Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafanato a version that resolves this vulnerability.Fixed in 0:9.2.10-38.el8_10 - Upgrade
Upgrade
rocky-linux/grafana-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.2.10-38.el8_10 - Upgrade
Upgrade
rocky-linux/grafana-debugsourceto a version that resolves this vulnerability.Fixed in 0:9.2.10-38.el8_10 - Upgrade
Upgrade
rocky-linux/grafana-selinuxto a version that resolves this vulnerability.Fixed in 0:9.2.10-38.el8_10
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction.
What is the impact indicated by the supplied severity vector?
The vector indicates a high availability impact, with no confidentiality or integrity impact represented in that vector. The advisory also identifies an information-disclosure issue in Grafana Unified Alerting, but provides no further impact conditions.
What input is involved in the denial-of-service issue?
The denial-of-service issue is associated with crafted zstd-compressed input in github.com/klauspost/compress/zstd.