Summary
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
* github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | grafana | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-debuginfo | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-debuginfo | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-debugsource | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-debugsource | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-selinux | 0:9.2.10-38.el8_10 |
| Rocky Linux · 8 | grafana-selinux | 0:9.2.10-38.el8_10 |
Vulnerabilities 2
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 7.1
CVE-2026-17183 CVE Record
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data ac…