Critical Security Update for grafana-pcp: IPv6 Host Literal Parsing Vulnerability
Summary
ALSA-2026:7009: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-13.el8_10. Fixed in 5.1.1-13.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot (PCP), which provides a robust framework for monitoring and analyzing system performance metrics. It includes various data sources for scalable time series data from pmseries and Redis, live PCP metrics, and bpftrace scripts from pmdabpftrace, along with several dashboards for visualization. This package is crucial for users who rely on real-time performance monitoring and analysis.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 pertains to incorrect parsing of IPv6 host literals in the net/url package. This flaw can potentially allow an attacker to manipulate the way URLs are processed, leading to unauthorized access or data leakage. The ramifications of this vulnerability could be severe, especially in environments where secure data transmission is critical, as it may expose sensitive information or allow for further exploitation of the system.
How To Fix
Minimum fixed version
5.1.1-13.el8_10
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected components or implement network-level controls to mitigate the risk of exploitation until the package can be updated. This may include firewall rules or access control lists to limit exposure.
Conclusion
The grafana-pcp package has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with CVE-2026-25679. Implementing workarounds can provide temporary relief, but a permanent fix through updates is essential for maintaining system security.
See every vulnerability recorded for grafana-pcp →
FAQ
CVE-2026-25679 is a vulnerability related to incorrect parsing of IPv6 host literals in the net/url package, affecting the grafana-pcp plugin.
This vulnerability can lead to unauthorized access or data leakage, compromising the security of your system's performance monitoring.
If an immediate update is not possible, consider implementing network-level controls to limit exposure to the vulnerability.
For detailed information, you can refer to the CVE page associated with CVE-2026-25679.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
