<div class="container">
<h1>Security update for grafana, system-user-grafana</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:4600-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-09T08:54:31Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262187">bsc#1262187</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1263330">bsc#1263330</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265525">bsc#1265525</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265763">bsc#1265763</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268868">bsc#1268868</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269841">bsc#1269841</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271330">bsc#1271330</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271557">bsc#1271557</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272008">bsc#1272008</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272328">bsc#1272328</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272427">bsc#1272427</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1274217">bsc#1274217</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275934">bsc#1275934</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276426">bsc#1276426</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276658">bsc#1276658</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276973">bsc#1276973</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1277025">bsc#1277025</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1278307">bsc#1278307</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1278322">bsc#1278322</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/MSQA-1060">jsc#MSQA-1060</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-1229.html">CVE-2026-1229</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-14199.html">CVE-2026-14199</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-17033.html">CVE-2026-17033</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-17183.html">CVE-2026-17183</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-19197.html">CVE-2026-19197</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-19475.html">CVE-2026-19475</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-21723.html">CVE-2026-21723</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-2303.html">CVE-2026-2303</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-33814.html">CVE-2026-33814</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39882.html">CVE-2026-39882</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-41178.html">CVE-2026-41178</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-41606.html">CVE-2026-41606</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-42127.html">CVE-2026-42127</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-56852.html">CVE-2026-56852</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-73501.html">CVE-2026-73501</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-8595.html">CVE-2026-8595</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-8609.html">CVE-2026-8609</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9029.html">CVE-2026-9029</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-14199</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-14199</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-14199</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17033</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17033</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17033</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17183</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-17183</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-19197</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-19197</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-19475</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-19475</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-21723</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-21723</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2303</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2303</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-2303</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33814</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33814</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33814</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33814</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39882</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39882</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41178</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41178</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41606</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41606</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41606</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41606</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42127</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42127</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-56852</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-56852</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-56852</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-73501</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-73501</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8595</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8595</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8595</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8609</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8609</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-8609</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9029</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9029</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9029</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9029</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP7</li>
<li class="list-group-item">SUSE Package Hub 15 15-SP7</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 18 vulnerabilities, contains one feature and has one security fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for grafana, system-user-grafana fixes the following issues:</p>
<ul>
<li>Update to version 12.4.10:</li>
<li>Security:
CVE-2026-17183: Fix exposing data accessible through Grafana's
configured datasource credentials (bsc#1275934)
CVE-2026-2303: Drop dependency on vulnerable
go.mongodb.org/mongo-driver (bsc#1269841)
CVE-2026-17033: Fix stored XSS via external Alertmanager
generatorURL (bsc#1276426)
CVE-2026-73501: Fix fail-open authentication bypass in
github.com/getkin/kin-openapi (bsc#1276973)
CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
CVE-2026-14199: Fix session takeover via Auth Proxy cache key
collision (bsc#1278322)</li>
<li>Bug fixes:
Dashboards: Fix adhoc and groupby variable datasource on UI
import
Dashboards: Fix version dates and user display names in the
legacy version history page</li>
<li>Update to version 12.4.9:</li>
<li>Features and enhancements:
Dashboard Import: Labels in v2 schema</li>
<li>Bug fixes:
Azure Monitor: fix migration for dimension filters</li>
<li>Update to version 12.4.8:</li>
<li>Security:
CVE-2026-19197: Fix access control in dashboard snapshots
(bsc#1277025)</li>
<li>Update to version 12.4.7:</li>
<li>Security:
CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8
input in golang.org/x/text/unicode/norm
(bsc#1272008)</li>
<li>Features and enhancements:
Dashboards: Get annotations and dashboard endpoint performance
improvements</li>
<li>Bug fixes:
DashboardDS: Fix Mixed panels with a time override stuck in
permanent loading</li>
<li>Update to version 12.4.6:</li>
<li>Security:
CVE-2026-41178: Fix opentelemetry-go's baggage parsing
(bsc#1276658)</li>
<li>Features and enhancements:
Alerting: Add protected fields authorization check to
provisioning API
Alerting: Return 403 instead of 500 on contact point provenance
mismatch</li>
<li>Bug fixes:
Jaeger: Handle gzip, deflate, and brotli compressed API
responses
Alerting: fix ORM table mapping bug causing SELECT alert_rule
columns FROM user on PostgreSQL</li>
<li>
<p>Drop 0005-Bump-edwards25519.patch</p>
<p>CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
OTLP HTTP exporters by updating to v1.43.0.
(bsc#1274217)
CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
public dashboard query endpoint (bsc#1268868)
CVE-2026-9029: Fix arbitrary code execution and information
disclosure via XSS in geomap panel (bsc#1272328)
CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
updating golang.org/x/net (bsc#1265763)
CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix
producing incorect output for specific inputs
(bsc#1265525)
(bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test
endpoint (bsc#1272427)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
- Build only for SUSE distributions</p>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Package Hub 15 15-SP7
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4600</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
<ul>
<li>grafana-debuginfo-12.4.10-150200.3.94.3</li>
<li>grafana-12.4.10-150200.3.94.3</li>
</ul>
</li>
<li>
SUSE Package Hub 15 15-SP7 (noarch)
<ul>
<li>system-user-grafana-1.0.0-150200.5.8.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-1229.html">https://www.suse.com/security/cve/CVE-2026-1229.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-14199.html">https://www.suse.com/security/cve/CVE-2026-14199.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-17033.html">https://www.suse.com/security/cve/CVE-2026-17033.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-17183.html">https://www.suse.com/security/cve/CVE-2026-17183.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-19197.html">https://www.suse.com/security/cve/CVE-2026-19197.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-19475.html">https://www.suse.com/security/cve/CVE-2026-19475.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-21723.html">https://www.suse.com/security/cve/CVE-2026-21723.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-2303.html">https://www.suse.com/security/cve/CVE-2026-2303.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-33814.html">https://www.suse.com/security/cve/CVE-2026-33814.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39882.html">https://www.suse.com/security/cve/CVE-2026-39882.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-41178.html">https://www.suse.com/security/cve/CVE-2026-41178.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-41606.html">https://www.suse.com/security/cve/CVE-2026-41606.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-42127.html">https://www.suse.com/security/cve/CVE-2026-42127.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-56852.html">https://www.suse.com/security/cve/CVE-2026-56852.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-73501.html">https://www.suse.com/security/cve/CVE-2026-73501.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-8595.html">https://www.suse.com/security/cve/CVE-2026-8595.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-8609.html">https://www.suse.com/security/cve/CVE-2026-8609.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9029.html">https://www.suse.com/security/cve/CVE-2026-9029.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262187">https://bugzilla.suse.com/show_bug.cgi?id=1262187</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1263330">https://bugzilla.suse.com/show_bug.cgi?id=1263330</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265525">https://bugzilla.suse.com/show_bug.cgi?id=1265525</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265763">https://bugzilla.suse.com/show_bug.cgi?id=1265763</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268868">https://bugzilla.suse.com/show_bug.cgi?id=1268868</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1269841">https://bugzilla.suse.com/show_bug.cgi?id=1269841</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271330">https://bugzilla.suse.com/show_bug.cgi?id=1271330</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271557">https://bugzilla.suse.com/show_bug.cgi?id=1271557</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272008">https://bugzilla.suse.com/show_bug.cgi?id=1272008</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272328">https://bugzilla.suse.com/show_bug.cgi?id=1272328</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272427">https://bugzilla.suse.com/show_bug.cgi?id=1272427</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1274217">https://bugzilla.suse.com/show_bug.cgi?id=1274217</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1275934">https://bugzilla.suse.com/show_bug.cgi?id=1275934</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276426">https://bugzilla.suse.com/show_bug.cgi?id=1276426</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276658">https://bugzilla.suse.com/show_bug.cgi?id=1276658</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1276973">https://bugzilla.suse.com/show_bug.cgi?id=1276973</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1277025">https://bugzilla.suse.com/show_bug.cgi?id=1277025</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1278307">https://bugzilla.suse.com/show_bug.cgi?id=1278307</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1278322">https://bugzilla.suse.com/show_bug.cgi?id=1278322</a>
</li>
<li>
<a href="https://jira.suse.com/browse/MSQA-1060">https://jira.suse.com/browse/MSQA-1060</a>
</li>
</ul>
</div>