Skip to content
OpenAdvisories
High ELSA-2026-19352 3 CVEs

Important: grafana security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[10.2.6-22]
- Resolves RHEL-161803: CVE-2026-27877
- Resolves RHEL-166678: CVE-2026-32282
- Resolves RHEL-167678: CVE-2026-32283

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 grafana 0:10.2.6-22.el9_8
Oracle Linux · 9 grafana-selinux 0:10.2.6-22.el9_8

Vulnerabilities 3

  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2026-27877

    Public dashboards discloses all direct mode datasources

    When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-s…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.4
    CVE-2026-32282

    TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

    Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go