Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21351-1

Опубликовано: 14 июл. 2026
Источник: suse-cvrf

Описание

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • Add UI web assets as additional source tarball

  • Update to version 12.4.5 (jsc#PED-16512):

    • Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

  • Update to version 12.4.4:

    • Security and quality updates.
    • Various bug fixes and enhancements.

  • Update to version 12.4.3:

    • Analytics: Keep internal dashboard id.
    • Go: Update to 1.25.9.
    • Reporting: Correctly apply appSubURL to report settings requests.
    • Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.

  • Update to version 12.4.2:

    • Various bug fixes and performance improvements.
    • Dependency updates to core plugins and UI libraries.

  • Update to version 12.4.1:

    • Bug fixes and minor quality-of-life enhancements.
    • Updates to data source provisioning and dashboard schemas.

  • Update to version 12.4.0:

    • Introduced dynamic dashboards in public preview.
    • Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
    • Added the ability to create dashboards from templates using sample data.
    • Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
    • Added support to map one variable to multiple values.
    • CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)

  • Update to version 12.3.0:

    • Released a completely redesigned logs visualization.
    • Added the ability to export dashboards directly as PNG images.
    • Introduced an interactive learning experience within the Grafana UI.
    • Added a Switch template variable type to quickly toggle between values in queries.
    • Added functionality to style table cells using CSS properties via the field cell option.

  • Update to version 12.2.0:

    • Routine feature enhancements, minor bug fixes, and security patches.

  • Update to version 12.1.0:

    • Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
    • Redesigned the alert rule list page.
    • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
    • Added support for Service Account Impersonation in the BigQuery data source.
    • Introduced the Grafana Advisor in public preview.

  • Update to version 12.0.0:

    • BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
    • BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
    • BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.
    • MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
    • Introduced a new dashboard schema to replace the original single grid layout.

  • CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Список пакетов

openSUSE Leap 16.0
grafana-12.4.5-bp160.1.1

Ссылки

Описание

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.

Затронутые продукты
openSUSE Leap 16.0:grafana-12.4.5-bp160.1.1
Ссылки

Описание

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked.

Затронутые продукты
openSUSE Leap 16.0:grafana-12.4.5-bp160.1.1
Ссылки

Описание

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Затронутые продукты
openSUSE Leap 16.0:grafana-12.4.5-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:21351-1