A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

  - A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by     sending concurrent requests that cause a fatal map access error. This results in complete service     unavailability requiring restart of the Grafana server. (CVE-2026-28379)

  - A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the     entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory     condition, potentially causing a denial of service. (CVE-2026-28383)

  - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive     structures. (CVE-2026-33818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

  - Public dashboards with annotations enabled did not limit their annotation timerange to the locked     timerange of the public dashboard. This means one could read the entire history of annotations visible on     the specific dashboard, even those outside the locked timerange. This did not leak any annotations that     would not otherwise be visible on the public dashboard. (CVE-2026-21722)

  - A resample query can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-27879)

  - A testdata data-source can be used to trigger out-of-memory crashes in Grafana. (CVE-2026-28375)

  - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or     streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access     to the Grafana Live API can trigger this issue. (CVE-2026-28376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
    This can lead to denial of service through memory exhaustion. (CVE-2026-42127)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing     unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of     service). (CVE-2026-8609)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body     before processing it. An attacker can send very large payloads that force excessive memory allocation,     potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0643 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-48712:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1,     protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON.
    This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A     crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack     to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.

    CVE-2026-10601:
    The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input     into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-     configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled     endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate     internal service data via Loki's CallResource which returns full HTTP response bodies.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source     plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data     source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious
    field name that executes as a script in the browser of any user who views the dashboard (stored cross-site
    scripting). (CVE-2026-8595)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

ID	Name	Product	Family	Type	Severity
360003	AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)	Nessus	Alma Linux Local Security Checks	Local	medium
353161	Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Rocky Linux Local Security Checks	Local	high
352462	AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)	Nessus	Alma Linux Local Security Checks	Local	high
448381	SCA: security update for github.com/grafana/grafana (GHSA-9493-h4f5-633x)	Tenable Cloud Security	SCA Checks	Local	medium
448381	SCA: security update for github.com/grafana/grafana (GHSA-9493-h4f5-633x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
329319	Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
328381	TencentOS Server 4: grafana (TSSA-2026:0643)	Nessus	Tencent Local Security Checks	Local	medium
322132	Linux Distros Unpatched Vulnerability : CVE-2026-10601	Nessus	Misc.	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-10601

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

medium

medium