Skip to content
OpenAdvisories
High RHSA-2026:3529 1 CVE

Red Hat Security Advisory: grafana security update

Published Mar 3, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream grafana 0:10.2.6-17.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream grafana-debuginfo 0:10.2.6-17.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream grafana-debugsource 0:10.2.6-17.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream grafana-selinux 0:10.2.6-17.el9_6

Vulnerabilities 1

  • High 8.1
    CVE-2026-21721 Public exploit

    Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

    The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This i…

    Grafana grafana/grafana grafana/grafana-enterprise grafana Web / CMS Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433242
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3529.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-21721
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-21721
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-21721
  • article
    https://grafana.com/security/security-advisories/CVE-2026-21721