Описание
ELSA-2026-89732: grafana security update (IMPORTANT)
[10.2.6-28.9]
- Rebuild against updated golang
- Resolves RHEL-290737
[10.2.6-28.9]
- CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting
- Resolves RHEL-290765
[10.2.6-28.8]
- Rebuild against updated golang
- Resolves RHEL-287475
- Resolves RHEL-279352
- Resolves RHEL-278978
- Resolves RHEL-278696
[10.2.6-28.7]
- Resolves RHEL-253142: CVE-2026-15815
[10.2.6-28.6]
- Resolves RHEL-261888: CVE-2026-84445
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
grafana
10.2.6-28.el10_2.9
grafana-selinux
10.2.6-28.el10_2.9
Oracle Linux x86_64
grafana
10.2.6-28.el10_2.9
grafana-selinux
10.2.6-28.el10_2.9
Связанные CVE
Связанные уязвимости
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.