Red Hat Security Advisory

RHSA-2026:54243

grafana security update

Released 2026-08-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-32.el8_10.1, grafana-selinux-9.2.10-32.el8_10.1

Fixes 2 records

TI-2026-30467 CVE-2026-42127 · GHSA-3w66-95m3-8jxg

Pre-authentication denial of service in the public dashboard query endpoint

LOW 39

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-400

TI-2026-25776 CVE-2026-33377 · GHSA-5cv7-h7gr-wjgh

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

LOW 33

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00226 Published 2026-05-13 Partial fix · 11.6.14+security-04, 12.2.8+security-04 +3 CWE-284