Threats affecting pkg:rpm/redhat/grafana

Multiple security vulnerabilities affecting Grafana as packaged in Red Hat Enterprise Linux 10 have been addressed in a security update. These include privilege escalation via dashboard overwrite, unauthorized access due to incorrect IPv6 allow-list defaults, and denial of service issues caused by unbounded memory growth and excessive memory allocation. The update also fixes various underlying Go language library vulnerabilities impacting certificate validation, email parsing, and HTML parsing. Red Hat rates the overall security impact as Moderate.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (CVE-2024-48949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.