Summary
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)
* github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | grafana | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debuginfo | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debuginfo | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debuginfo | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debuginfo | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debugsource | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debugsource | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debugsource | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-debugsource | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-selinux | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-selinux | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-selinux | 0:10.2.6-24.el9_9.8 |
| Rocky Linux · 9 | grafana-selinux | 0:10.2.6-24.el9_9.8 |
Vulnerabilities 2
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 7.7
Azure Monitor access token disclosure via SSRF
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).