Organization admins can delete pending invites created in an organization they are not part of.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789290656 advisory.

  - During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Organization admins can delete pending invites created in an organization they are not part of.
    (CVE-2024-10452)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Organization admins can delete pending invites created in an organization they are not part of.
    (CVE-2024-10452)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0596 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-1088:
    An access control vulnerability was discovered in Grafana OSS where an Organization administrator could     permanently delete the Server administrator account. This vulnerability exists in the DELETE     /api/org/users/ endpoint.

    The vulnerability can be exploited when:

    1. An Organization administrator exists

    2. The Server administrator is either:

     - Not part of any organization, or
     - Part of the same organization as the Organization administrator     Impact:

    - Organization administrators can permanently delete Server administrator accounts

    - If the only Server administrator is deleted, the Grafana instance becomes unmanageable

    - No super-user permissions remain in the system

    - Affects all users, organizations, and teams managed in the instance

    The vulnerability is particularly serious as it can lead to a complete loss of administrative control over     the Grafana instance.

    CVE-2024-10452:
    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing     integration was not properly protected and could be exposed to users with Viewer permission.
    Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01,     11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

    CVE-2025-3580:
    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become     unresponsive due to Improper Input Validation vulnerability in Grafana.
    This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

    CVE-2025-3415:
    Organization admins can delete pending invites created in an organization they are not part of.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3950-1 advisory.

    - Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
      * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
      * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
      * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
      * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
      * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
      * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
      * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
      * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

    - Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
      * GO-2024-3245 CVE-2024-39720
      * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
360694	AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789290656)	Nessus	Alma Linux Local Security Checks	Local	low
353161	Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Rocky Linux Local Security Checks	Local	high
352462	AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Alma Linux Local Security Checks	Local	high
446619	SCA: security update for github.com/grafana/grafana (GHSA-66c4-2g2v-54qw)	Tenable Cloud Security	SCA Checks	Local	low
446619	SCA: security update for github.com/grafana/grafana (GHSA-66c4-2g2v-54qw)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
250899	Linux Distros Unpatched Vulnerability : CVE-2024-10452	Nessus	Misc.	Local	low
249979	TencentOS Server 4: grafana (TSSA-2025:0596)	Nessus	Tencent Local Security Checks	Local	low
210710	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3950-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2024-10452

low

Tenable Plugins

low

high

high

low

low

low

low

high