The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1037-1 advisory.

    - Security issues fixed:

      - CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled     (bsc#1258136)
      - CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
      - CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
      - CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)
      - CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)

    - Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:

      - Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and         removed blurred backgrounds from UI overlays to speed up the interface.
      - One-Click Actions: Visualizations now support faster navigation via one-click links and actions.
      - Alerting History: Added version history for alert rules, allowing you to track changes over time.
      - Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon     startup.
      - Cron Support: Annotations now support Cron syntax for more flexible scheduling.
      - Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login     redirection issues         when Grafana is hosted on a subpath.
      - Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend     formatting.
      - Alerting Limits: Added size limits for expanded notification templates to prevent system strain.
      - RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field.
      - Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled     in repeated         rows or nested queries.
      - Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links.
      - Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed     issues where         contact points weren't working correctly.
      - URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1013-1 advisory.

    dracut-saltboot:

    - Version update to 1.1.0:

      * Retry DHCP requests up to 3 times (bsc#1253004)

    golang-github-QubitProducts-exporter_exporter:

    - Non-customer-facing optimization and update

    golang-github-boynux-squid_exporter:

    - Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):

      * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path
      * Added TLS and Basic Authentication to the exporters web interface
      * Added support for the exporter to authenticate against the Squid proxy itself
      * Allow the gathering of process information without requiring root privileges
      * The exporter can now be configured using environment variables
      * Added support for custom labels to all exported metrics for better data filtering
      * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors     occurred
      * Added 'service time' metrics to analyze proxy speed and performance.
      * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks
      * Corrected the squid_client_http_requests_total metric to ensure accurate reporting


    golang-github-lusitaniae-apache_exporter:

    - Version update from 1.0.8 to 1.0.10:

      * Updated github.com/prometheus/client_golang to 1.21.1
      * Updated github.com/prometheus/common to 0.63.0
      * Updated github.com/prometheus/exporter-toolkit to 0.14.0
      * Fixed signal handler logging

    golang-github-prometheus-prometheus:

    - Security issues fixed:

      * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption     (bsc#1257841)
      * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897,     bsc#1257442)
      * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability     (bsc#1257329)
      * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications     (bsc#1255588)

    - Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):

      * Modernized Interface: Introduced a brand-new UI
      * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload     Identity support         for more secure, native cloudauthentication.
      * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms     from experimental         to a stable feature.
      * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling     when sending         data to external systems.
      * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for     grouping         operations
      * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts,     making it easier         to troubleshoot why targets aren't reporting correctly.
      * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where     targets were         accidentally being scraped multiple times

    grafana:

    - Security issues fixed:

      * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled     (bsc#1258136)
      * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
      * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
      * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)
      * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)

    - Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:

      * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and         removed blurred backgrounds from UI overlays to speed up the interface
      * One-Click Actions: Visualizations now support faster navigation via one-click links and actions
      * Alerting History: Added version history for alert rules, allowing you to track changes over time
      * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
      * Cron Support: Annotations now support Cron syntax for more flexible scheduling
      * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login     redirection issues         when Grafana is hosted on a subpath
      * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend     formatting
      * Alerting Limits: Added size limits for expanded notification templates to prevent system strain
      * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
      * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled     in repeated         rows or nested queries
      * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links
      * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed     issues where         contact points weren't working correctly
      * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly

    prometheus-blackbox_exporter:

    - Non-customer-facing optimization and update

    spacecmd:

    - Version update to 5.0.15:

      * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)
      * Convert cached IDs to integer values (bsc#1251995)
      * Fixed spacecmd binary file upload (bsc#1253659)

    uyuni-tools:

    - Version update to 0.1.38:

      * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)
      * Detect custom apache and squid config in the /etc/uyuni/proxy folder
      * Add ssh tuning to configure sshd (bsc#1253738)
      * Ignore supportconfig errors (bsc#1255781)
      * Bumped the default image tag to 5.0.7
      * Removed cgroup mount for podman containers (bsc#1253347)
      * Registry flag can be a string (bsc#1254589)
      * Use static supportconfig name to avoid dynamic search (bsc#1257941)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3529 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2914 advisory.

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2920 advisory.

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3078 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-210:03 advisory.

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)
      * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)
      * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)
      * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
      * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2914 advisory.

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)
      * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)
      * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)
      * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
      * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2920 advisory.

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)
      * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)
      * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)
      * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
      * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2920 advisory.

    - Resolves RHEL-144959: CVE-2026-21721
    - Resolves RHEL-146863: CVE-2025-61726
    - Resolves RHEL-147081: CVE-2025-61729
    - Resolves RHEL-147370: CVE-2025-61728
    - Resolves RHEL-149621: CVE-2025-68121
    - Resolves RHEL-125692: CVE-2025-58183
    - Resolves RHEL-89953: CVE-2025-4123
    - Resolves RHEL-84636: CVE-2025-30204
    - Resolves RHEL-62312: CVE-2024-47875

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2920 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2914 advisory.

    - Resolves RHEL-144948: CVE-2026-21721
    - Resolves RHEL-146721: CVE-2025-61726
    - Resolves RHEL-146926: CVE-2025-61729
    - Resolves RHEL-147351: CVE-2025-61728

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2914 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate     (CVE-2025-61729)

    * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables     Cross?Dashboard Privilege Escalation (CVE-2026-21721)

    * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip     (CVE-2025-61728)

    * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is affected by a privilege escalation vulnerability as referenced in the CVE-2026-21721 advisory. 

  - The dashboard permissions API does not verify the target dashboard scope and only checks the     dashboards.permissions:* action. As a result, a user who has permission management rights on one     dashboard can read and modify permissions on other dashboards. This is an organization‑internal     privilege escalation. (CVE-2026-21721)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The dashboard permissions API does not verify the target dashboard scope and only checks the     dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard     can read and modify permissions on other dashboards. This is an organizationinternal privilege     escalation. (CVE-2026-21721)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303789	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2026:1037-1)	Nessus	SuSE Local Security Checks	high
303779	SUSE SLES15 / openSUSE 15 : Security update 5.0.7 for Multi-Linux Manager Client Tools (SUSE-SU-2026:1013-1)	Nessus	SuSE Local Security Checks	critical
300812	RHEL 9 : grafana (RHSA-2026:3529)	Nessus	Red Hat Local Security Checks	high
300055	RockyLinux 10 : grafana (RLSA-2026:2914)	Nessus	Rocky Linux Local Security Checks	critical
300040	RockyLinux 9 : grafana (RLSA-2026:2920)	Nessus	Rocky Linux Local Security Checks	critical
299784	RHEL 10 : grafana (RHSA-2026:3078)	Nessus	Red Hat Local Security Checks	high
299683	MiracleLinux 9 : grafana-10.2.6-18.el9_7 (AXSA:2026-210:03)	Nessus	Miracle Linux Local Security Checks	critical
299669	AlmaLinux 10 : grafana (ALSA-2026:2914)	Nessus	Alma Linux Local Security Checks	critical
299606	AlmaLinux 9 : grafana (ALSA-2026:2920)	Nessus	Alma Linux Local Security Checks	critical
299510	Oracle Linux 9 : grafana (ELSA-2026-2920)	Nessus	Oracle Linux Local Security Checks	critical
299501	RHEL 9 : grafana (RHSA-2026:2920)	Nessus	Red Hat Local Security Checks	critical
299482	Oracle Linux 10 : grafana (ELSA-2026-2914)	Nessus	Oracle Linux Local Security Checks	critical
299418	RHEL 10 : grafana (RHSA-2026:2914)	Nessus	Red Hat Local Security Checks	critical
297197	Grafana Labs 10.2.0 < 11.6.9+security-01 / 12.0.0 < 12.0.8+security-01 / 12.1.0 < 12.1.5+security-01 / 12.2.0 < 12.2.3+security-01 / 12.3.0 < 12.3.1+security-01 Privilege Escalation (CVE-2026-21721)	Nessus	Web Servers	high
297049	Linux Distros Unpatched Vulnerability : CVE-2026-21721	Nessus	Misc.	high

Detections

Analytics

CVE-2026-21721

high

Tenable Plugins

high

critical

high

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

high

high