Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3714-1 advisory.

    prometheus-postgres_exporter:

    - CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation     bypass       and privilege escalation (bsc#1248699)

    golang-github-prometheus-alertmanager:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version     0.55.0 (bsc#1266615)

    golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

    Security fixes:

    - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0     (bsc#1274221)
    - CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router     (bsc#1267416)
    - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
    - CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3718-1 advisory.

    grafana updated from version 11.6.14+security04 to version 12.4.5:

    Security fixes:

    - CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
    - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints     (bsc#1271331)
    - CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
    - CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

    Breaking chahnges introduced in version 12.0.0:

    - BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.
    - BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
    - BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect     UIDs.


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54178 advisory.

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    Bug Fix(es) and Enhancement(s):

    * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54178 advisory.

    - Resolves RHEL-211020: CVE-2026-33377
    - Resolves RHEL-211376: CVE-2026-8609
    - Resolves RHEL-210981: CVE-2026-33376
    - Resolves RHEL-211389: CVE-2026-33382

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54178 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    Bug Fix(es) and Enhancement(s):

    * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:RHEL-188282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
    This can lead to denial of service through memory exhaustion. (CVE-2026-42127)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing     unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of     service). (CVE-2026-8609)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body     before processing it. An attacker can send very large payloads that force excessive memory allocation,     potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21366-1 advisory.

    Changes in grafana:

    - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints     (bsc#1271331)
    - CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious
    field name that executes as a script in the browser of any user who views the dashboard (stored cross-site
    scripting). (CVE-2026-8595)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

ID	Name	Product	Family	Type	Severity
339763	SUSE SLES15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:3714-1)	Nessus	SuSE Local Security Checks	Local	high
339730	SUSE SLES15 Security Update : grafana (SUSE-SU-2026:3718-1)	Nessus	SuSE Local Security Checks	Local	medium
335184	RockyLinux 10 : grafana (RLSA-2026:54178)	Nessus	Rocky Linux Local Security Checks	Local	high
334989	Oracle Linux 10 : grafana (ELSA-2026-54178)	Nessus	Oracle Linux Local Security Checks	Local	high
334850	RHEL 10 : grafana (RHSA-2026:54178)	Nessus	Red Hat Local Security Checks	Local	high
329319	Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
327813	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:21366-1)	Nessus	SuSE Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-33382

high

Tenable Plugins

high

medium

high

high

high

medium

medium

medium

medium