Поиск уязвимостей

Important: grafana security update

ELSA-2026-89732: grafana security update (IMPORTANT)

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrar ...

Уязвимость grafana

Уязвимость grafana

Summary An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource. The alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid. ## Impact This bypass can expose data accessible through Grafana's configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High. Integrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated. ## Attack prerequisites - Authenticated, low-privileged user in the same G...

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Уязвимость пакетов net/textproto и mime/multipart языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании

Important: yggdrasil security update

ELSA-2026-91138: yggdrasil security update (IMPORTANT)

Critical: grafana security update

ELSA-2026-89744: grafana security update (CRITICAL)

Important: grafana-pcp security update