Description
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana | 9.3.0 – < 11.6.14, 12.0.0 – < 12.1.10, 12.2.0 – < 12.2.8, 12.3.0 – < 12.3.6, 12.4.0 – < 12.4.2 | 11.6.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | grafana +1 | 10.2.6-24.el10_1 | RHSA-2026:19134, RHSA-2026:10223 |
| RHEL 9 | grafana +1 | 10.2.6-20.el9_7 | RHSA-2026:19352, RHSA-2026:10226 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | grafana +1 | 10.2.6-23.el10_0 | RHSA-2026:11417 |
| RHEL 9.6 EUS | grafana +1 | 10.2.6-20.el9_6 | RHSA-2026:11416 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | grafana +1 | 10.2.6-24.el10_1 | ALSA-2026:19134, ALSA-2026:10223 |
| AlmaLinux 9 | grafana +1 | 10.2.6-20.el9_7 | ALSA-2026:19352, ALSA-2026:10226 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | grafana | 10.2.6-24.el10_1 | RLSA-2026:19134, RLSA-2026:10223 |
| Rocky Linux 9 | grafana | 10.2.6-20.el9_7 | RLSA-2026:19352, RLSA-2026:10226 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.0-150002.3.8.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security01-150002.4.14.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.1.13-150002.3.9.3 | SUSE-SU-2026:1524-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.26-150002.3.12.1 | SUSE-SU-2026:1524-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 11.6.14+security01-1.1 | openSUSE-SU-2026:10601-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 | openSUSE-SU-2026:20940-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.3-r0 | — |
| Alpine v3.23 | grafana | 12.2.8-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | grafana +1 | 10.2.6-24.el10_1 | ELSA-2026-19134, ELSA-2026-10223 |
| Oracle Linux 9 | grafana +1 | 10.2.6-20.el9_7 | ELSA-2026-19352, ELSA-2026-10226 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 9.3.0 | — | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | >= 12.0.0 | — | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | >= 12.2.0 | — | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | >= 12.3.0 | — | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | >= 12.4.0 | — | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | >= 1.9.2-0.20221116104934-4ee83a5f2bf4, < 1.9.2-0.20260325055210-3522153e07b4 | 1.9.2-0.20260325055210-3522153e07b4 | GHSA-3q27-7qjq-p9c5 |
| Go | github.com/grafana/grafana | all versions | — | GO-2026-5095 |
Advisories 23
- ALSA-2026:10223 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19352 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:10226 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19134 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:19352 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19134 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:11417 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:11416 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:10226 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:10223 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- WID-SEC-2026-0899 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 23, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- ELSA-2026-19134 Important: grafana security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- ELSA-2026-19352 Important: grafana security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- openSUSE-SU-2026:20940-1 Security update for grafana SUSE / openSUSE Security Updates · Jun 13, 2026
- RLSA-2026:19134 Important: grafana security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19352 Important: grafana security update Rocky Linux Security Advisories · May 28, 2026
- RLSA-2026:10223 Important: grafana security update Rocky Linux Security Advisories · Apr 28, 2026
- RLSA-2026:10226 Important: grafana security update Rocky Linux Security Advisories · Apr 28, 2026
- ELSA-2026-10226 Important: grafana security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 24, 2026
- openSUSE-SU-2026:10601-1 grafana-11.6.14+security01-1.1 on GA media SUSE / openSUSE Security Updates · Apr 23, 2026
- ELSA-2026-10223 Important: grafana security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 23, 2026
- SUSE-SU-2026:1524-1 Security update 5.1.3 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Apr 22, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-27877 vendor-advisory