OPENSUSE-SU-2026:22125-1: grafana&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:22125-1 is a vulnerability in grafana&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for grafana This update for grafana fixes the following issues: Changes in grafana: Update to version 12.4.10: * Security: * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322) * Bug fixes: * Dashboards: Fix adhoc and groupby variable datasource on UI import * Dashboards: Fix version dates and user display names in the legacy version history page Update to version 12.4.9: * Features and enhancements: * Dashboard Import: Labels in v2 schema * Bug fixes: * Azure Monitor: fix migration for dimension filters Update to version 12.4.8: * Security: * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025) Update to version 12.4.7: * Security: * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008) * Features and enhancements: * Dashboards: Get annotations and dashboard endpoint performance improvements * Bug fixes: * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading Update to version 12.4.6: * Security: * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658) * Features and enhancements: * Alerting: Add protected fields authorization check to provisioning API * Alerting: Return 403 instead of 500 on contact point provenance mismatch * Bug fixes: * Jaeger: Handle gzip, deflate, and brotli compressed API responses * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330) * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187) * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427) * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

No weakness data has been published for this record.