Critical Security Update for grafana-pcp: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:63136: Important: grafana-pcp security update. Affects grafana-pcp versions < 5.1.1-17.el9_8.1. Fixed in 5.1.1-17.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grafana-pcp package is a Grafana plugin designed for Performance Co-Pilot, which provides scalable time series data sources from pmseries and Redis, live metrics, and various dashboards. This package is essential for monitoring and visualizing performance metrics in real-time, making it a valuable tool for system administrators and developers. However, it has been identified to contain several security vulnerabilities that could potentially compromise the integrity and availability of systems utilizing this plugin.
Vulnerability Detail
The vulnerabilities in grafana-pcp stem from multiple components within the Go programming language libraries. These include a Denial of Service (DoS) vulnerability due to excessive recursion in the Unmarshal function (CVE-2026-33818), quadratic complexity in path resolution (CVE-2026-56860), Cross-Site Scripting (XSS) via pathological input in html/template (CVE-2026-56858), and a DoS vulnerability from indefinite KeyUpdate messages in crypto/tls (CVE-2026-56862). These vulnerabilities can lead to service disruptions, data breaches, and exploitation of the application by malicious actors.
How To Fix
Minimum fixed version
5.1.1-17.el9_8.1
This is the first release that contains the fix.
sudo dnf update grafana-pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the grafana-pcp plugin or disable it until the update is applied. Additionally, ensure that your application is behind a firewall and monitor for any unusual activity.
Conclusion
The grafana-pcp plugin has been identified with critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard your systems from potential attacks. Regular monitoring and updates are crucial for maintaining security in your applications.
See every vulnerability recorded for grafana-pcp →
FAQ
grafana-pcp is a Grafana plugin that integrates Performance Co-Pilot for monitoring and visualizing performance metrics.
The vulnerabilities can lead to Denial of Service attacks, Cross-Site Scripting, and potential exploitation by attackers, compromising system integrity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, you can limit access to the grafana-pcp plugin or disable it until the patch is applied.
It is recommended to regularly check for updates and apply them promptly to ensure your software is secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for grafana-pcp.
