Skip to content
OpenAdvisories
High RHSA-2026:54243 2 CVEs

Red Hat Security Advisory: grafana security update

Published Sep 17, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana 0:9.2.10-32.el8_10.1
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-debuginfo 0:9.2.10-32.el8_10.1
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-debugsource 0:9.2.10-32.el8_10.1
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-selinux 0:9.2.10-32.el8_10.1

Vulnerabilities 2

  • High 7.5
    CVE-2026-42127

    Pre-authentication denial of service in the public dashboard query endpoint

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exh…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi Go
  • High 7.1
    CVE-2026-33377

    Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

    An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

    Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491449
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54243.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33377
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33377
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33377
  • article
    https://grafana.com/security/security-advisories/cve-2026-33377
  • report
    https://access.redhat.com/security/cve/CVE-2026-42127
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42127
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42127
  • article
    https://grafana.com/security/security-advisories/cve-2026-42127