Critical Privilege Escalation Vulnerability in grafana-pcp Package
Summary
ALSA-2026:35826: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.3.0-7.el10_2. Fixed in 5.3.0-7.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot (PCP), which provides a robust framework for monitoring and analyzing performance metrics. It includes various data sources for scalable time series data from pmseries and Redis, live metrics from PCP, and bpftrace scripts from pmdabpftrace. This package is essential for users who require real-time insights into system performance, but it has been found to have a critical security vulnerability that could allow unauthorized privilege escalation.
Vulnerability Detail
The vulnerability arises from improper processing of Punycode labels in the golang.org/x/net/idna library, which can lead to privilege escalation. Specifically, an attacker could exploit this flaw to gain elevated permissions within the system, potentially compromising sensitive data and system integrity. The vulnerability is identified as CVE-2026-39821 and poses significant risks to users relying on the grafana-pcp package for performance monitoring.
How To Fix
Minimum fixed version
5.3.0-7.el10_2
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider restricting access to the grafana-pcp functionalities until the package is updated. This can be done by modifying user permissions or disabling the plugin in Grafana until the patch is applied.
Conclusion
The grafana-pcp package has a critical vulnerability that can lead to privilege escalation, necessitating immediate action from users to update to the latest patched version. By following the outlined steps to fix the vulnerability and considering the provided workarounds, users can mitigate the risks associated with this security issue.
See every vulnerability recorded for grafana-pcp →
FAQ
The vulnerability can lead to privilege escalation, allowing attackers to gain unauthorized access to system resources and sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider restricting access to the functionalities of grafana-pcp as a temporary workaround.
It is recommended to check for updates regularly, ideally on a weekly basis, to ensure that all security vulnerabilities are addressed promptly.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, helping you maintain security without needing to access the code directly.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
