Summary
[10.2.6-23]
- Resolves RHEL-183803: CVE-2026-39821
- Resolves RHEL-188280
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | grafana | 0:10.2.6-23.el9_8.2 |
| Oracle Linux · 9 | grafana-selinux | 0:10.2.6-23.el9_8.2 |
Vulnerabilities 2
-
High 7.4
Auth Proxy IPv6 whitelist bypass
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML,…
-
High 7.1
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.