SUSE-SU-2026:4600-1: important: Security update for grafana, system-user-grafana
SLE-SECURITY-UPDATES
null at suse.de
Fri Oct 9 16:31:23 UTC 2026
# Security update for grafana, system-user-grafana
Announcement ID: SUSE-SU-2026:4600-1
Release Date: 2026-10-09T08:54:31Z
Rating: important
References:
* bsc#1262187
* bsc#1263330
* bsc#1265525
* bsc#1265763
* bsc#1268868
* bsc#1269841
* bsc#1271330
* bsc#1271557
* bsc#1272008
* bsc#1272328
* bsc#1272427
* bsc#1274217
* bsc#1275934
* bsc#1276426
* bsc#1276658
* bsc#1276973
* bsc#1277025
* bsc#1278307
* bsc#1278322
* jsc#MSQA-1060
Cross-References:
* CVE-2026-1229
* CVE-2026-14199
* CVE-2026-17033
* CVE-2026-17183
* CVE-2026-19197
* CVE-2026-19475
* CVE-2026-21723
* CVE-2026-2303
* CVE-2026-33814
* CVE-2026-39882
* CVE-2026-41178
* CVE-2026-41606
* CVE-2026-42127
* CVE-2026-56852
* CVE-2026-73501
* CVE-2026-8595
* CVE-2026-8609
* CVE-2026-9029
CVSS scores:
* CVE-2026-1229 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2026-1229 ( SUSE ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
* CVE-2026-1229 ( NVD ): 2.9
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber
* CVE-2026-1229 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-14199 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-14199 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-14199 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-17033 ( SUSE ): 7.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-17033 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
* CVE-2026-17033 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
* CVE-2026-17183 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
* CVE-2026-17183 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
* CVE-2026-19197 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-19197 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-19475 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-19475 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21723 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21723 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-2303 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
* CVE-2026-2303 ( NVD ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-2303 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39882 ( SUSE ): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39882 ( NVD ): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-41178 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41178 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41606 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-41606 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41606 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41606 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-42127 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-42127 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56852 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56852 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56852 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-73501 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-73501 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-8595 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-8595 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-8595 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
* CVE-2026-8609 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-8609 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-8609 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-9029 ( SUSE ): 4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-9029 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-9029 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-9029 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products:
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves 18 vulnerabilities, contains one feature and has one
security fix can now be installed.
## Description:
This update for grafana, system-user-grafana fixes the following issues:
* Update to version 12.4.10:
* Security: CVE-2026-17183: Fix exposing data accessible through Grafana's
configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop
dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL
(bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in
github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in
PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via
Auth Proxy cache key collision (bsc#1278322)
* Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI
import Dashboards: Fix version dates and user display names in the legacy
version history page
* Update to version 12.4.9:
* Features and enhancements: Dashboard Import: Labels in v2 schema
* Bug fixes: Azure Monitor: fix migration for dimension filters
* Update to version 12.4.8:
* Security: CVE-2026-19197: Fix access control in dashboard snapshots
(bsc#1277025)
* Update to version 12.4.7:
* Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input
in golang.org/x/text/unicode/norm (bsc#1272008)
* Features and enhancements: Dashboards: Get annotations and dashboard
endpoint performance improvements
* Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in
permanent loading
* Update to version 12.4.6:
* Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing
(bsc#1276658)
* Features and enhancements: Alerting: Add protected fields authorization
check to provisioning API Alerting: Return 403 instead of 500 on contact
point provenance mismatch
* Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses
Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM
user on PostgreSQL
* Drop 0005-Bump-edwards25519.patch
CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP
exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in
the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion
in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix
arbitrary code execution and information disclosure via XSS in geomap panel
(bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating
golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the
OAuth login route (bsc#1271330) * CVE-2026-1229: Update
github.com/cloudflare/circl to fix producing incorect output for specific inputs
(bsc#1265525) (bsc#1262187) * CVE-2026-21723: Fix DoS vulnerability in Templates
Test endpoint (bsc#1272427) \- CVE-2026-41606: Fix potential DoS in Apache
Thrift (bsc#1263330) \- Build only for SUSE distributions
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4600
## Package List:
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* grafana-debuginfo-12.4.10-150200.3.94.3
* grafana-12.4.10-150200.3.94.3
* SUSE Package Hub 15 15-SP7 (noarch)
* system-user-grafana-1.0.0-150200.5.8.1
## References:
* https://www.suse.com/security/cve/CVE-2026-1229.html
* https://www.suse.com/security/cve/CVE-2026-14199.html
* https://www.suse.com/security/cve/CVE-2026-17033.html
* https://www.suse.com/security/cve/CVE-2026-17183.html
* https://www.suse.com/security/cve/CVE-2026-19197.html
* https://www.suse.com/security/cve/CVE-2026-19475.html
* https://www.suse.com/security/cve/CVE-2026-21723.html
* https://www.suse.com/security/cve/CVE-2026-2303.html
* https://www.suse.com/security/cve/CVE-2026-33814.html
* https://www.suse.com/security/cve/CVE-2026-39882.html
* https://www.suse.com/security/cve/CVE-2026-41178.html
* https://www.suse.com/security/cve/CVE-2026-41606.html
* https://www.suse.com/security/cve/CVE-2026-42127.html
* https://www.suse.com/security/cve/CVE-2026-56852.html
* https://www.suse.com/security/cve/CVE-2026-73501.html
* https://www.suse.com/security/cve/CVE-2026-8595.html
* https://www.suse.com/security/cve/CVE-2026-8609.html
* https://www.suse.com/security/cve/CVE-2026-9029.html
* https://bugzilla.suse.com/show_bug.cgi?id=1262187
* https://bugzilla.suse.com/show_bug.cgi?id=1263330
* https://bugzilla.suse.com/show_bug.cgi?id=1265525
* https://bugzilla.suse.com/show_bug.cgi?id=1265763
* https://bugzilla.suse.com/show_bug.cgi?id=1268868
* https://bugzilla.suse.com/show_bug.cgi?id=1269841
* https://bugzilla.suse.com/show_bug.cgi?id=1271330
* https://bugzilla.suse.com/show_bug.cgi?id=1271557
* https://bugzilla.suse.com/show_bug.cgi?id=1272008
* https://bugzilla.suse.com/show_bug.cgi?id=1272328
* https://bugzilla.suse.com/show_bug.cgi?id=1272427
* https://bugzilla.suse.com/show_bug.cgi?id=1274217
* https://bugzilla.suse.com/show_bug.cgi?id=1275934
* https://bugzilla.suse.com/show_bug.cgi?id=1276426
* https://bugzilla.suse.com/show_bug.cgi?id=1276658
* https://bugzilla.suse.com/show_bug.cgi?id=1276973
* https://bugzilla.suse.com/show_bug.cgi?id=1277025
* https://bugzilla.suse.com/show_bug.cgi?id=1278307
* https://bugzilla.suse.com/show_bug.cgi?id=1278322
* https://jira.suse.com/browse/MSQA-1060
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261009/7c6c7cba/attachment.htm>
More information about the sle-security-updates
mailing list