Grafana: Mehrere Schwachstellen ermöglichen Manipulation von Dateien und DoS

Summary

Product

Vulnerabilities 2

• Medium 6.5
  CVE-2026-33375

  Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

  The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

  Grafana Grafana OSS grafana Web / CMS Alpine
  Mar 26, 2026
• Medium 5.4
  CVE-2026-21724

  Missing Protected-field Authorization in Provisioning Contact Points API

  A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permissio…

  Grafana Grafana OSS grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  Mar 26, 2026

Revision history

1. 2026-06-04 #2

   Neue Updates von SUSE aufgenommen

2. 2026-03-26 #1

   Initiale Fassung

References

• Grafana Security Advisories vom 2026-03-26
  https://grafana.com/security/security-advisories/cve-2026-21724/
• Grafana Security Advisories vom 2026-03-26
  https://grafana.com/security/security-advisories/cve-2026-33375/
• SUSE Security Update SUSE-SU-2026:2258-1 vom 2026-06-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026563.html