Description
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | 9.4.0 – ≤ 11.6.14, 11.6.14 – < 11.6.14+security-04, 12.0.0 – ≤ 12.2.8, 12.2.8 – < 12.2.8+security-04, 12.3.0 – ≤ 12.3.6, 12.3.6 – < 12.3.6+security-04, 12.4.0 – ≤ 12.4.3, 12.4.3 – < 12.4.3+security-02, 13.0.0 – ≤ 13.0.1, 13.0.1 – < 13.0.1+security-01 | 11.6.14+security-04 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | grafana +1 | 10.2.6-28.el10_2.4 | RHSA-2026:54178 |
| RHEL 9 | grafana +1 | 10.2.6-23.el9_8.2 | RHSA-2026:58982 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | grafana +1 | 10.2.6-26.el10_0 | RHSA-2026:67517 |
| RHEL 9.6 EUS | grafana +1 | 10.2.6-23.el9_6 | RHSA-2026:67518 |
| RHEL 9.4 E4S | grafana +1 | 9.2.10-28.el9_4 | RHSA-2026:76795 |
| RHEL 9.2 E4S | grafana | 9.0.9-13.el9_2 | RHSA-2026:76809 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.6.hum1 | RHSA-2026:68821 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.6-0.1.hum1 | RHSA-2026:68767 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.5.hum1 | RHSA-2026:68778 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | grafana +1 | 10.2.6-28.el10_2.4 | ALSA-2026:54178 |
| AlmaLinux 9 | grafana +1 | 10.2.6-23.el9_8.2 | ALSA-2026:58982 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | grafana | 10.2.6-28.el10_2.4 | RLSA-2026:98056, RLSA-2026:54178 |
| Rocky Linux 10 | grafana-selinux | 12.4.3-3.el10_3.2 | RLSA-2026:98056 |
| Rocky Linux 9 | grafana | 10.2.6-23.el9_8.2 | RLSA-2026:58982 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | grafana | 12.4.5-150200.3.91.1 | SUSE-SU-2026:3718-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | dracut-saltboot | 1.2.1-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-boynux-squid_exporter | 1.13.0-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.9.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-node_exporter | 1.10.2-150002.3.6.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.3-150002.3.13.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security04-150002.4.21.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.4-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.11.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-postgres_exporter | 0.10.1-150002.3.3.2 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | python-defusedxml-sle15 | 0.7.1-150002.1.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | rhnlib | 5.2.5-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.8-150002.3.12.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.6-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-salt | 1.2.3-150002.3.3.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | supportutils-plugin-susemanager-client | 5.2.3-150002.3.9.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-common-libs | 5.2.5-150002.3.6.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.12-150002.3.17.1 | SUSE-SU-2026:2768-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 | 5.1.4-8.22.10 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-image +3 | 5.1.4-8.20.34 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 | 5.1.4-6.24.3 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-server-saline-image +3 | 5.1.4-9.20.24 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Server Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 | 5.1.4-8.22.22 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 | 5.1.4-9.20.25 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 | 5.1.4-8.20.11 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 | 5.1.4-8.20.12 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 | 5.1.4-8.20.13 | SUSE-SU-2026:2774-1 |
| SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 | uyuni-tools | 5.1.29-150700.3.26.1 | SUSE-SU-2026:2774-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 11.6.14+security04-1.1 | openSUSE-SU-2026:10932-1 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 | openSUSE-SU-2026:20940-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | grafana +1 | 10.2.6-28.el10_2.4 | ELSA-2026-54178 |
| Oracle Linux 9 | grafana +1 | 10.2.6-23.el9_8.2 | ELSA-2026-58982 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.4 | 12.4.3.02-r0 | — |
Advisories 22
- RLSA-2026:98056 Important: grafana security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-1546 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:54178 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58982 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:76795 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76809 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68821 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67518 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67517 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68778 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:68767 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:58982 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:54178 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- SUSE-SU-2026:3718-1 Security update for grafana SUSE / openSUSE Security Updates · Aug 26, 2026
- RLSA-2026:58982 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 25, 2026
- ELSA-2026-58982 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- RLSA-2026:54178 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 13, 2026
- ELSA-2026-54178 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 12, 2026
- SUSE-SU-2026:2774-1 Security update 5.1.4 for Multi-Linux Manager Server SUSE / openSUSE Security Updates · Jul 7, 2026
- SUSE-SU-2026:2768-1 Security update 5.1.4 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Jul 7, 2026
- openSUSE-SU-2026:20940-1 Security update for grafana SUSE / openSUSE Security Updates · Jun 13, 2026
- openSUSE-SU-2026:10932-1 grafana-11.6.14+security04-1.1 on GA media SUSE / openSUSE Security Updates · Jun 3, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-33376 vendor-advisory