Skip to content
OpenAdvisories
High ELSA-2026-54243 2 CVEs

Important: grafana security update (Oracle Linux 8)

Published Aug 13, 2026 · Updated Aug 13, 2026

Ecosystem: Oracle Linux

Summary

[9.2.10-32.0.1.el8_10.1]
- Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520]

[9.2.10-32.1]
- Resolves RHEL-219393: CVE-2026-42127
- Resolves RHEL-211017: CVE-2026-33377

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 grafana 0:9.2.10-32.0.1.el8_10.1
Oracle Linux · 8 grafana-selinux 0:9.2.10-32.0.1.el8_10.1

Vulnerabilities 2

  • High 7.5
    CVE-2026-42127

    Pre-authentication denial of service in the public dashboard query endpoint

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exh…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi Go
  • High 7.1
    CVE-2026-33377

    Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

    An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

    Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi