SUSE-SU-2026:1037-1

Advisory lineage Upstream: 5 Downstream: 0
Published: 25 Mar 2026, 10:31
Last modified:26 Mar 2026, 09:02

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Mar 2026, 10:31
Published
Vulnerability first disclosed
26 Mar 2026, 09:02
Last Modified
Vulnerability information updated

Description

Security update for grafana This update for grafana fixes the following issues: - Security issues fixed: - CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136) - CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337) - CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349) - CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340) - CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302) - Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes: - Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface. - One-Click Actions: Visualizations now support faster navigation via one-click links and actions. - Alerting History: Added version history for alert rules, allowing you to track changes over time. - Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup. - Cron Support: Annotations now support Cron syntax for more flexible scheduling. - Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath. - Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting. - Alerting Limits: Added size limits for expanded notification templates to prevent system strain. - RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field. - Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries. - Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links. - Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where contact points weren't working correctly. - URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly

Affected Systems

  • opensuse•grafana&distro=openSUSE Leap 15.6

    < 11.6.11-150200.3.83.1

  • suse•grafana&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7

    < 11.6.11-150200.3.83.1

References (11)