Red Hat Security Advisory: grafana security update

Fixed packages 4

Vulnerabilities 2

• High 7.5
  CVE-2026-94440

  Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

  Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

  Go standard library net/textproto mime/multipart golang Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 8, 2026
• High 7.1
  CVE-2026-17183

  CVE-2026-17183 CVE Record

  An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data ac…

  Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine
  Aug 19, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519801
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548341
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89732.json
• report
  https://access.redhat.com/security/cve/CVE-2026-17183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-17183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-17183
• article
  https://grafana.com/security/security-advisories/cve-2026-17183
• report
  https://access.redhat.com/security/cve/CVE-2026-94440
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-94440
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-94440
• article
  https://go.dev/cl/847307
• article
  https://go.dev/issue/81741
• article
  https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• advisory
  https://pkg.go.dev/vuln/GO-2026-6608