SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)

medium Nessus Plugin ID 369265

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory.

- Update to version 12.4.10:
* Security:
CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
* Bug fixes:
Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page
- Update to version 12.4.9:
* Features and enhancements:
Dashboard Import: Labels in v2 schema
* Bug fixes:
Azure Monitor: fix migration for dimension filters
- Update to version 12.4.8:
* Security:
CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)
- Update to version 12.4.7:
* Security:
CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
* Features and enhancements:
Dashboards: Get annotations and dashboard endpoint performance improvements
* Bug fixes:
DashboardDS: Fix Mixed panels with a time override stuck in permanent loading
- Update to version 12.4.6:
* Security:
CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
* Features and enhancements:
Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
* Bug fixes:
Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL
- Drop 0005-Bump-edwards25519.patch

CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0.
(bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
- Build only for SUSE distributions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana and / or system-user-grafana packages.

Plugin Details

Severity: Medium

ID: 369265

File Name: suse_SU-2026-4600-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/21/2026

Updated: 10/21/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-1229

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-2303

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:grafana, p-cpe:/a:novell:suse_linux:system-user-grafana

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2026

Vulnerability Publication Date: 2/10/2026

Reference Information

CVE: CVE-2026-1229, CVE-2026-14199, CVE-2026-17033, CVE-2026-17183, CVE-2026-19197, CVE-2026-19475, CVE-2026-21723, CVE-2026-2303, CVE-2026-33814, CVE-2026-39882, CVE-2026-41178, CVE-2026-41606, CVE-2026-42127, CVE-2026-56852, CVE-2026-73501, CVE-2026-8595, CVE-2026-8609, CVE-2026-9029

IAVB: 2026-B-0198-S

SuSE: SUSE-SU-2026:4600-1

Detections

Analytics