Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-21722 EUVD-2026-7041GHSA-3f33-44xm-29m7

Public Dashboards time range restriction on annotations can be bypassed

Published Feb 12, 2026 · Updated Aug 27, 2026 · Assigned by GRAFANA

Vendor: Grafana Product: grafana/grafana Product: grafana/grafana-enterprise Package: grafana Category: Web / CMS Ecosystem: Ubuntu

Description

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

This did not leak any annotations that would not otherwise be visible on the public dashboard.

Affected products

VendorProductAffectedFixed
Grafana grafana/grafana 9.3.0 – < 11.6.10+security-01, 12.0.0 – < 12.1.6+security-01, 12.2.0 – < 12.2.4+security-01, 12.3.0 – < 12.3.2+security-01 11.6.10+security-01
Grafana grafana/grafana-enterprise 9.3.0 – < 11.6.10+security-01, 12.0.0 – < 12.1.6+security-01, 12.2.0 – < 12.2.4+security-01, 12.3.0 – < 12.3.2+security-01 11.6.10+security-01

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 golang-github-prometheus-promu 0.17.0-150000.3.30.1 SUSE-SU-2026:1013-1
SLES 15 SP7 grafana 11.6.11-150200.3.83.1 SUSE-SU-2026:1037-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 prometheus-blackbox_exporter 0.26.0-150002.3.6.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.1.26-150002.3.12.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-150002.3.6.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.5.0-150002.3.8.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.6.14+security01-150002.4.14.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-blackbox_exporter 0.26.0-150002.3.6.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.1.13-150002.3.9.3 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.1.26-150002.3.12.1 SUSE-SU-2026:1524-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 Multi-Linux-ManagerTools-Beta-SLE-Micro-release 5-159000.3.3.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 dracut-saltboot 1.1.0-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 dracut-wireless 0.1.1595937550.0285244-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 golang-github-prometheus-node_exporter 1.9.1-159000.4.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 uyuni-tools 5.2.5-159000.2.3.2 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-Micro-5 venv-salt-minion 3006.0-159000.5.3.2 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 dracut-saltboot 1.1.0-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 dracut-wireless 0.1.1595937550.0285244-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-boynux-squid_exporter 1.13.0-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-prometheus-alertmanager 0.28.1-159000.12.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-prometheus-node_exporter 1.9.1-159000.4.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 golang-github-prometheus-prometheus 3.5.0-159000.4.3.2 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 grafana 11.6.11-159000.2.3.2 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 mgr-push +1 5.2.3-159000.2.3.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 prometheus-blackbox_exporter 0.26.0-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 prometheus-postgres_exporter 0.10.1-159000.2.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 python-defusedxml 0.7.1-159000.4.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 rhnlib +1 5.2.4-159000.4.3.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 spacecmd 5.2.6-159000.4.3.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 supportutils-plugin-salt 1.2.3-159000.4.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 supportutils-plugin-susemanager-client 5.2.2-159000.4.2.1 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 uyuni-tools 5.2.5-159000.2.3.2 SUSE-SU-2026:1148-1
SUSE Multi Linux Manager Tools Beta SLE-15 venv-salt-minion 3006.0-159000.5.3.2 SUSE-SU-2026:1148-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 1.1.0-150000.1.65.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-150000.1.21.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools for SLE Micro 5 prometheus-blackbox_exporter 0.26.0-150000.1.30.2 SUSE-SU-2026:1013-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-tools 0.1.38-150000.1.30.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 dracut-saltboot 1.1.0-150000.1.65.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-150000.1.21.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.13.0-150000.1.12.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.10-150000.1.26.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 3.5.0-150000.3.67.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 grafana 11.6.11-150000.1.90.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.26.0-150000.1.30.2 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 spacecmd 5.0.15-150000.3.142.1 SUSE-SU-2026:1013-1
SUSE Manager Client Tools 15 uyuni-tools 0.1.38-150000.1.30.1 SUSE-SU-2026:1013-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 11.6.14+security01-1.1 openSUSE-SU-2026:10601-1
openSUSE Leap 15.6 dracut-saltboot 1.1.0-150000.1.65.1 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 golang-github-QubitProducts-exporter_exporter 0.4.0-150000.1.21.1 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 golang-github-boynux-squid_exporter 1.13.0-150000.1.12.1 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 golang-github-lusitaniae-apache_exporter 1.0.10-150000.1.26.1 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 golang-github-prometheus-promu 0.17.0-150000.3.30.1 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 grafana 11.6.11-150200.3.83.1 SUSE-SU-2026:1037-1
openSUSE Leap 15.6 prometheus-blackbox_exporter 0.26.0-150000.1.30.2 SUSE-SU-2026:1013-1
openSUSE Leap 15.6 spacecmd 5.0.15-150000.3.142.1 SUSE-SU-2026:1013-1

Advisories 6

References