Description
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | grafana +12 | 6.7.4-3.el8 | RHSA-2020:4682 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-38.el8 | RHSA-2020:2861, RHSA-2020:2796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | grafana +12 | 6.7.4-3.el8 | ALSA-2020:4682 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | grafana +12 | 6.7.4-3.el8 | ELSA-2020-4682 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | < 7.0.0 | 7.0.0 | GHSA-7m2x-qhrq-rp8h |
| Go | github.com/grafana/grafana | all versions | — | GO-2024-2515 |
Advisories 5
- ALSA-2020:4682 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2020:2861 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2796 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:4682 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ELSA-2020-4682 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020