An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-90811 advisory.

    - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting
    - Resolves RHEL-253159: CVE-2026-15815
    - CVE-2026-42504 grafana: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90811 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory.

    Changes in grafana:

    Update to version 12.4.10:

      * Security:

        * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials     (bsc#1275934)
        * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
        * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
        * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
        * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
        * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

      * Bug fixes:

        * Dashboards: Fix adhoc and groupby variable datasource on UI import
        * Dashboards: Fix version dates and user display names in the legacy version history page

    Update to version 12.4.9:

      * Features and enhancements:

        * Dashboard Import: Labels in v2 schema

      * Bug fixes:

        * Azure Monitor: fix migration for dimension filters

    Update to version 12.4.8:

      * Security:

        * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

    Update to version 12.4.7:

      * Security:

        * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm     (bsc#1272008)

      * Features and enhancements:

        * Dashboards: Get annotations and dashboard endpoint performance improvements

      * Bug fixes:

        * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

    Update to version 12.4.6:

      * Security:

        * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

      * Features and enhancements:

        * Alerting: Add protected fields authorization check to provisioning API
        * Alerting: Return 403 instead of 500 on contact point provenance mismatch

      * Bug fixes:

        * Jaeger: Handle gzip, deflate, and brotli compressed API responses
        * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

    * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to     v1.43.0.  (bsc#1274217)
    * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint     (bsc#1268868)
    * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel     (bsc#1272328)
    * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
    * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
    * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs     (bsc#1265525) (bsc#1262187)
    * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
    * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory.

    - Update to version 12.4.10:
      * Security:
        CVE-2026-17183: Fix exposing data accessible through Grafana's                         configured datasource credentials (bsc#1275934)         CVE-2026-2303: Drop dependency on vulnerable                        go.mongodb.org/mongo-driver (bsc#1269841)         CVE-2026-17033: Fix stored XSS via external Alertmanager                         generatorURL (bsc#1276426)         CVE-2026-73501: Fix fail-open authentication bypass in                         github.com/getkin/kin-openapi (bsc#1276973)         CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)         CVE-2026-14199: Fix session takeover via Auth Proxy cache key                         collision (bsc#1278322)
      * Bug fixes:
        Dashboards: Fix adhoc and groupby variable datasource on UI                     import         Dashboards: Fix version dates and user display names in the                     legacy version history page
    - Update to version 12.4.9:
      * Features and enhancements:
        Dashboard Import: Labels in v2 schema
      * Bug fixes:
        Azure Monitor: fix migration for dimension filters
    - Update to version 12.4.8:
      * Security:
        CVE-2026-19197: Fix access control in dashboard snapshots                         (bsc#1277025)
    - Update to version 12.4.7:
      * Security:
        CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8                         input in golang.org/x/text/unicode/norm                         (bsc#1272008)
      * Features and enhancements:
        Dashboards: Get annotations and dashboard endpoint performance                     improvements
      * Bug fixes:
        DashboardDS: Fix Mixed panels with a time override stuck in                      permanent loading
    - Update to version 12.4.6:
      * Security:
        CVE-2026-41178: Fix opentelemetry-go's baggage parsing                         (bsc#1276658)
      * Features and enhancements:
        Alerting: Add protected fields authorization check to                   provisioning API         Alerting: Return 403 instead of 500 on contact point provenance                   mismatch
      * Bug fixes:
        Jaeger: Handle gzip, deflate, and brotli compressed API                 responses         Alerting: fix ORM table mapping bug causing SELECT alert_rule                   columns FROM user on PostgreSQL
    - Drop 0005-Bump-edwards25519.patch

        CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry                         OTLP HTTP exporters by updating to v1.43.0.
                        (bsc#1274217)         CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)         CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a                         public dashboard query endpoint (bsc#1268868)         CVE-2026-9029: Fix arbitrary code execution and information                        disclosure via XSS in geomap panel (bsc#1272328)         CVE-2026-33814: Fix infinite loop in HTTP/2 transport by                         updating golang.org/x/net (bsc#1265763)         CVE-2026-8609: Fix pre-authentication DoS in the OAuth login                        route (bsc#1271330)
      * CVE-2026-1229: Update github.com/cloudflare/circl to fix                        producing incorect output for specific inputs                        (bsc#1265525)                         (bsc#1262187)
      * CVE-2026-21723: Fix DoS vulnerability in Templates Test                         endpoint (bsc#1272427)
    - CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
    - Build only for SUSE distributions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_54178 advisory.

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    Bug Fix(es) and Enhancement(s):

    * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67517 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint     application (CVE-2026-33810)

    * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect     Punycode label processing (CVE-2026-39821)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree     rendering (CVE-2026-42502)

    * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads     (CVE-2026-42127)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)

    * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)

    * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)

    * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)

    * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54178 advisory.

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    Bug Fix(es) and Enhancement(s):

    * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54178 advisory.

    - Resolves RHEL-211020: CVE-2026-33377
    - Resolves RHEL-211376: CVE-2026-8609
    - Resolves RHEL-210981: CVE-2026-33376
    - Resolves RHEL-211389: CVE-2026-33382

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54178 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

    * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default     (CVE-2026-33376)

    * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

    * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads     (CVE-2026-33382)

    Bug Fix(es) and Enhancement(s):

    * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:RHEL-188282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - The public dashboard query endpoint does not limit request body size before processing, allowing     unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
    This can lead to denial of service through memory exhaustion. (CVE-2026-42127)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing     unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of     service). (CVE-2026-8609)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body     before processing it. An attacker can send very large payloads that force excessive memory allocation,     potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's
    XYZ tile layer via a template variable. The script then executes in the browser of any user who views the
    affected dashboard (stored cross-site scripting). (CVE-2026-9029)

  - A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious
    field name that executes as a script in the browser of any user who views the dashboard (stored cross-site
    scripting). (CVE-2026-8595)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source
    plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data
    source credentials, leak internal responses, or trigger administrative actions on the configured backend.
    (CVE-2026-10601)

ID	Name	Product	Family	Type	Severity
375509	Oracle Linux 9 : grafana (ELSA-2026-90811)	Nessus	Oracle Linux Local Security Checks	Local	high
373930	RHEL 9 : grafana (RHSA-2026:90811)	Nessus	Red Hat Local Security Checks	Local	high
370424	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)	Nessus	SuSE Local Security Checks	Local	medium
369265	SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)	Nessus	SuSE Local Security Checks	Local	medium
357882	Rocky Linux 10.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_54178)	Nessus	Rocky Linux Local Security Checks	Local	high
345859	RHEL 10 : grafana (RHSA-2026:67517)	Nessus	Red Hat Local Security Checks	Local	high
335184	RockyLinux 10 : grafana (RLSA-2026:54178)	Nessus	Rocky Linux Local Security Checks	Local	high
334989	Oracle Linux 10 : grafana (ELSA-2026-54178)	Nessus	Oracle Linux Local Security Checks	Local	high
334850	RHEL 10 : grafana (RHSA-2026:54178)	Nessus	Red Hat Local Security Checks	Local	high
329319	Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
443182	Alpine: multiple grafana packages: security update to 12.4.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-8609

high

Tenable Plugins

high

high

medium

medium

high

high

high

high

high

medium

medium

medium