Skip to content
OpenAdvisories
High RHSA-2026:58982 2 CVEs

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Published Aug 25, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana 0:10.2.6-23.el9_8.2
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debuginfo 0:10.2.6-23.el9_8.2
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debugsource 0:10.2.6-23.el9_8.2
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-selinux 0:10.2.6-23.el9_8.2

Vulnerabilities 2

  • High 7.4
    CVE-2026-33376

    Auth Proxy IPv6 whitelist bypass

    When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML,…

    Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi
  • High 7.1
    CVE-2026-33377

    Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

    An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

    Grafana Grafana OSS grafana grafana-12.4 Web / CMS Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477262
  • article
    https://issues.redhat.com/browse/RHEL-242865
  • article
    https://issues.redhat.com/browse/RHEL-242866
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58982.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33376
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33376
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33376
  • article
    https://grafana.com/security/security-advisories/cve-2026-33376
  • report
    https://access.redhat.com/security/cve/CVE-2026-33377
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33377
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33377
  • article
    https://grafana.com/security/security-advisories/cve-2026-33377