ALT-PU-2026-15352: package grafana update to version 12.3.6-alt1
Описание
This update upgrades grafana to version 12.3.6-alt1.
Устраненные уязвимости26
Ссылки4
GHSA-3q27-7qjq-p9c5
https://github.com/advisories/GHSA-3q27-7qjq-p9c5GHSA-p5x9-j974-rpfp
https://github.com/advisories/GHSA-p5x9-j974-rpfpGHSA-w62r-7c53-fmc5
https://github.com/advisories/GHSA-w62r-7c53-fmc5Связанные уязвимости
ALT-PU-2026-2386: package `grafana` update to version 12.3.2-alt1
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
In Grafana's alerting system, users with edit permissions for a contac ...