This Red Hat security advisory addresses four vulnerabilities in Grafana: CVE-2026-33377 (privilege escalation via dashboard overwrite), CVE-2026-33376 (unauthorized access due to incorrect IPv6 allow-list default in Grafana Auth Proxy), CVE-2026-8609 (denial of service via unbounded memory growth in OAuth login route), and CVE-2026-33382 (denial of service via excessive memory allocation from large API request payloads). The advisory provides updated Grafana packages for Red Hat Enterprise Linux 10 across multiple architectures. No CVSS scores are provided in the advisory, but the overall impact is rated moderate by Red Hat. The advisory includes references to the CVE pages for detailed impact and scoring information.

The vulnerabilities allow for privilege escalation, unauthorized access, and denial of service conditions in Grafana deployments. Privilege escalation could enable attackers to gain higher-level access by overwriting dashboards. Incorrect IPv6 allow-list defaults could permit unauthorized users to bypass authentication. Denial of service vulnerabilities could cause service disruption by exhausting memory resources. These issues affect Grafana as deployed on Red Hat Enterprise Linux 10 and related variants.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2026:54178 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the official patches.