Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 13

• ALSA-2020:4682 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
• WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
• RHSA-2020:2861 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:2796 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
• RHSA-2020:4682 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
• WID-SEC-2026-0777 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
• SUSE-SU-2020:2911-1 Security update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-RU-2020:2161-1 Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, o SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2021:1233-1 Security update for grafana and system-user-grafana SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2021:1962-1 Security update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2020:1901-1 Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-im SUSE / openSUSE Security Updates · Feb 4, 2026
• ELSA-2020-4682 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020

References

• https://community.grafana.com/t/release-notes-v6-7-x/27119
• https://security.netapp.com/advisory/ntap-20200511-0001/