An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl
    greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity
    attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who
    shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is
    live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
    (CVE-2026-14199)

  - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the
    InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay
    protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session
    as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this
    setting is off by default and Grafana OSS is not affected. (CVE-2026-12704)

  - An authenticated user can list alert rules stored in folders they are not allowed to read through the
    alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction
    was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can
    trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not
    exposed. (CVE-2026-13719)

  - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and
    grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these
    fields were stored without an authorization check. The dashboard then appears file-provisioned, and
    administrators can no longer update or delete it through Grafana. The impact is limited to the same
    organization and no data is exposed. (CVE-2026-13720)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2189:34 advisory.

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
      * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
      * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references     (CVE-2026-97031)
      * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of     Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
      * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates     (CVE-2026-111943)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_89732 advisory.

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart     form parsing (CVE-2026-94440)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_89744 advisory.

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

    * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references     (CVE-2026-97031)

    * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive     HTTP/2 SETTINGS frames (CVE-2026-78669)

    * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates     (CVE-2026-111943)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89744 advisory.

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

    * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references     (CVE-2026-97031)

    * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive     HTTP/2 SETTINGS frames (CVE-2026-78669)

    * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates     (CVE-2026-111943)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89732 advisory.

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart     form parsing (CVE-2026-94440)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89744 advisory.

    - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting
    - Resolves RHEL-253159: CVE-2026-15815
    - CVE-2026-42504 grafana: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89732 advisory.

    - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting       in Unified Alerting
    - Resolves RHEL-253142: CVE-2026-15815

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89744 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

    * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references     (CVE-2026-97031)

    * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive     HTTP/2 SETTINGS frames (CVE-2026-78669)

    * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates     (CVE-2026-111943)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89732 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)

    * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart     form parsing (CVE-2026-94440)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory.

    Changes in grafana:

    Update to version 12.4.10:

      * Security:

        * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials     (bsc#1275934)
        * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
        * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
        * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
        * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
        * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

      * Bug fixes:

        * Dashboards: Fix adhoc and groupby variable datasource on UI import
        * Dashboards: Fix version dates and user display names in the legacy version history page

    Update to version 12.4.9:

      * Features and enhancements:

        * Dashboard Import: Labels in v2 schema

      * Bug fixes:

        * Azure Monitor: fix migration for dimension filters

    Update to version 12.4.8:

      * Security:

        * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

    Update to version 12.4.7:

      * Security:

        * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm     (bsc#1272008)

      * Features and enhancements:

        * Dashboards: Get annotations and dashboard endpoint performance improvements

      * Bug fixes:

        * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

    Update to version 12.4.6:

      * Security:

        * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

      * Features and enhancements:

        * Alerting: Add protected fields authorization check to provisioning API
        * Alerting: Return 403 instead of 500 on contact point provenance mismatch

      * Bug fixes:

        * Jaeger: Handle gzip, deflate, and brotli compressed API responses
        * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

    * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to     v1.43.0.  (bsc#1274217)
    * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint     (bsc#1268868)
    * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel     (bsc#1272328)
    * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
    * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
    * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs     (bsc#1265525) (bsc#1262187)
    * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
    * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory.

    - Update to version 12.4.10:
      * Security:
        CVE-2026-17183: Fix exposing data accessible through Grafana's                         configured datasource credentials (bsc#1275934)         CVE-2026-2303: Drop dependency on vulnerable                        go.mongodb.org/mongo-driver (bsc#1269841)         CVE-2026-17033: Fix stored XSS via external Alertmanager                         generatorURL (bsc#1276426)         CVE-2026-73501: Fix fail-open authentication bypass in                         github.com/getkin/kin-openapi (bsc#1276973)         CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)         CVE-2026-14199: Fix session takeover via Auth Proxy cache key                         collision (bsc#1278322)
      * Bug fixes:
        Dashboards: Fix adhoc and groupby variable datasource on UI                     import         Dashboards: Fix version dates and user display names in the                     legacy version history page
    - Update to version 12.4.9:
      * Features and enhancements:
        Dashboard Import: Labels in v2 schema
      * Bug fixes:
        Azure Monitor: fix migration for dimension filters
    - Update to version 12.4.8:
      * Security:
        CVE-2026-19197: Fix access control in dashboard snapshots                         (bsc#1277025)
    - Update to version 12.4.7:
      * Security:
        CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8                         input in golang.org/x/text/unicode/norm                         (bsc#1272008)
      * Features and enhancements:
        Dashboards: Get annotations and dashboard endpoint performance                     improvements
      * Bug fixes:
        DashboardDS: Fix Mixed panels with a time override stuck in                      permanent loading
    - Update to version 12.4.6:
      * Security:
        CVE-2026-41178: Fix opentelemetry-go's baggage parsing                         (bsc#1276658)
      * Features and enhancements:
        Alerting: Add protected fields authorization check to                   provisioning API         Alerting: Return 403 instead of 500 on contact point provenance                   mismatch
      * Bug fixes:
        Jaeger: Handle gzip, deflate, and brotli compressed API                 responses         Alerting: fix ORM table mapping bug causing SELECT alert_rule                   columns FROM user on PostgreSQL
    - Drop 0005-Bump-edwards25519.patch

        CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry                         OTLP HTTP exporters by updating to v1.43.0.
                        (bsc#1274217)         CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)         CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a                         public dashboard query endpoint (bsc#1268868)         CVE-2026-9029: Fix arbitrary code execution and information                        disclosure via XSS in geomap panel (bsc#1272328)         CVE-2026-33814: Fix infinite loop in HTTP/2 transport by                         updating golang.org/x/net (bsc#1265763)         CVE-2026-8609: Fix pre-authentication DoS in the OAuth login                        route (bsc#1271330)
      * CVE-2026-1229: Update github.com/cloudflare/circl to fix                        producing incorect output for specific inputs                        (bsc#1265525)                         (bsc#1262187)
      * CVE-2026-21723: Fix DoS vulnerability in Templates Test                         endpoint (bsc#1272427)
    - CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
    - Build only for SUSE distributions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0962 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-17183:
    An authenticated organization user who can create or edit alert rules in a folder can query a datasource     for which they do not have datasources:query permission, by setting the client-controlled query field     queryType to __expr__ while retaining the UID of a real datasource, bypassing datasource permission     enforcement in Grafana's Unified Alerting (ngalert).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An authenticated user with permission to create or edit alert rules can bypass datasource query     authorization by marking an alert rule query as a server-side expression while referencing a real     datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured     datasource credentials to users who lack permission to query that datasource. (CVE-2026-17183)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
373046	MiracleLinux 9 : grafana-10.2.6-23.el9_8.7 (AXSA:2026-2189:34)	Nessus	Miracle Linux Local Security Checks	Local	high
372960	Rocky Linux 10.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_89732)	Nessus	Rocky Linux Local Security Checks	Local	high
372938	Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_89744)	Nessus	Rocky Linux Local Security Checks	Local	high
372441	RockyLinux 9 : grafana (RLSA-2026:89744)	Nessus	Rocky Linux Local Security Checks	Local	high
372433	RockyLinux 10 : grafana (RLSA-2026:89732)	Nessus	Rocky Linux Local Security Checks	Local	high
372073	Oracle Linux 9 : grafana (ELSA-2026-89744)	Nessus	Oracle Linux Local Security Checks	Local	high
372064	Oracle Linux 10 : grafana (ELSA-2026-89732)	Nessus	Oracle Linux Local Security Checks	Local	high
372014	RHEL 9 : grafana (RHSA-2026:89744)	Nessus	Red Hat Local Security Checks	Local	high
372005	RHEL 10 : grafana (RHSA-2026:89732)	Nessus	Red Hat Local Security Checks	Local	high
370424	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)	Nessus	SuSE Local Security Checks	Local	medium
369265	SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)	Nessus	SuSE Local Security Checks	Local	medium
343523	TencentOS Server 4: grafana (TSSA-2026:0962)	Nessus	Tencent Local Security Checks	Local	high
338255	Linux Distros Unpatched Vulnerability : CVE-2026-17183	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-17183

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

medium

medium

high

high