Grafana XSS via a query alias for the ElasticSearch datasource

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Affected packages

Advisories 7

• RHSA-2021:1859 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Mar 27, 2026
• RLSA-2021:1859 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
• SUSE-SU-2020:3897-1 Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2021:1233-1 Security update for grafana and system-user-grafana SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2021:1962-1 Security update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2020:3624-1 Security update for crowbar-openstack, grafana, influxdb, python-urllib3 SUSE / openSUSE Security Updates · May 2, 2025
• ELSA-2021-1859 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021

References

• https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01
• https://github.com/grafana/grafana/pull/25401
• https://security.netapp.com/advisory/ntap-20201123-0002/