Critical Privilege Escalation Vulnerability in grafana-pcp Package
Summary
ALSA-2026:35829: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-17.el9_8. Fixed in 5.1.1-17.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, providing data sources for scalable time series metrics from pmseries and Redis, live PCP metrics, and bpftrace scripts from pmdabpftrace. It also includes various dashboards for visualizing performance data. This package is crucial for monitoring and analyzing system performance, making it a key component for users relying on Grafana for real-time data visualization.
Vulnerability Detail
The vulnerability identified as CVE-2026-39821 affects the grafana-pcp package due to improper handling of Punycode label processing in the golang.org/x/net/idna library. This flaw can lead to privilege escalation, allowing an attacker to gain unauthorized access or control over the system. The issue arises from the way the library processes certain inputs, which could be exploited to manipulate system behavior, potentially leading to severe security breaches.
How To Fix
Minimum fixed version
5.1.1-17.el9_8
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to restrict access to the grafana-pcp plugin until the package can be updated. This can be achieved by modifying user permissions or disabling the plugin in the Grafana settings.
Conclusion
The grafana-pcp package has a critical vulnerability that can lead to privilege escalation. It is essential for users to update to the latest patched version to secure their systems. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for grafana-pcp →
FAQ
CVE-2026-39821 is a security vulnerability in the grafana-pcp package that allows for privilege escalation due to improper Punycode label processing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to system resources, which can lead to data breaches, system manipulation, and other malicious activities.
Yes, a patch is available in version 5.1.1-17.el9_8 of the grafana-pcp package. It is recommended to update to this version or later.
If an immediate update is not possible, consider restricting access to the grafana-pcp plugin as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
