p PatchFirst

openSUSE-SU-2026:22125-1

openSUSE-SU-2026:22125-1 · Security update for grafana

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for grafana fixes the following issues: Changes in grafana: Update to version 12.4.10: * Security: * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322) * Bug fixes: * Dashboards: Fix adhoc and groupby variable datasource on UI import * Dashboards: Fix version dates and user display names in the legacy version history page Update to version 12.4.9: * Features and enhancements: * Dashboard Import: Labels in v2 schema * Bug fixes: * Azure Monitor: fix migration for dimension filters Update to version 12.4.8: * Security: * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025) Update to version 12.4.7: * Security: * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008) * Features and enhancements: * Dashboards: Get annotations and dashboard endpoint performance improvements * Bug fixes: * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading Update to version 12.4.6: * Security: * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658) * Features and enhancements: * Alerting: Add protected fields authorization check to provisioning API * Alerting: Return 403 instead of 500 on contact point provenance mismatch * Bug fixes: * Jaeger: Handle gzip, deflate, and brotli compressed API responses * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330) * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187) * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427) * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • grafana openSUSE:Leap 16.0

    Affected ranges
    • ECOSYSTEM: < 12.4.10-bp160.1.1

    Update to 12.4.10-bp160.1.1

Original sources

Check your server →