Critical Security Update for Grafana: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:11712: Important: grafana security update. Affects grafana versions < 0:10.2.6-25.el10_1. Fixed in 0:10.2.6-25.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source platform designed for monitoring and visualizing metrics from various data sources such as Graphite, InfluxDB, and OpenTSDB. It provides a rich set of features including customizable dashboards, alerting capabilities, and extensive plugin support. However, recent security vulnerabilities have been identified that could potentially compromise the integrity and availability of the system.
Vulnerability Detail
The vulnerabilities identified in Grafana stem from issues in the Go programming language libraries. The first vulnerability (CVE-2026-32282) allows the Root.Chmod function to follow symbolic links outside of the intended root directory, potentially leading to unauthorized file access or modifications. The second vulnerability (CVE-2026-32283) is a Denial of Service (DoS) issue that can be triggered by sending multiple TLS 1.3 key update messages, which may overwhelm the server and disrupt service availability. Both vulnerabilities pose significant risks to system security and operational continuity.
How To Fix
Minimum fixed version
0:10.2.6-25.el10_1
This is the first release that contains the fix.
sudo dnf update grafanaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Grafana server and monitor for unusual activity while planning the update. Additionally, consider disabling TLS 1.3 if feasible until the update can be applied.
Conclusion
In summary, Grafana has critical vulnerabilities that need immediate attention. Updating to the latest version will mitigate these risks and enhance the security of your monitoring setup. Utilize tools like Vulert to stay informed about potential vulnerabilities in your software.
See every vulnerability recorded for grafana →
FAQ
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources.
The vulnerabilities include a potential unauthorized file access issue due to symbolic link handling and a Denial of Service attack via multiple TLS 1.3 key updates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for the vulnerabilities is 7.8, indicating a high level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure that your installation remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
