openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)

medium Nessus Plugin ID 370424

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory.

Changes in grafana:

Update to version 12.4.10:

* Security:

* CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
* CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
* CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
* CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
* CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
* CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

* Bug fixes:

* Dashboards: Fix adhoc and groupby variable datasource on UI import
* Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

* Features and enhancements:

* Dashboard Import: Labels in v2 schema

* Bug fixes:

* Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

* Security:

* CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

* Security:

* CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

* Features and enhancements:

* Dashboards: Get annotations and dashboard endpoint performance improvements

* Bug fixes:

* DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

* Security:

* CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

* Features and enhancements:

* Alerting: Add protected fields authorization check to provisioning API
* Alerting: Return 403 instead of 500 on contact point provenance mismatch

* Bug fixes:

* Jaeger: Handle gzip, deflate, and brotli compressed API responses
* Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

* CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)
* CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)
* CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)
* CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
* CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
* CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana package.

Plugin Details

Severity: Medium

ID: 370424

File Name: openSUSE-2026-22125-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-1229

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-2303

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:grafana

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2026

Vulnerability Publication Date: 2/10/2026

Reference Information

CVE: CVE-2026-1229, CVE-2026-14199, CVE-2026-17033, CVE-2026-17183, CVE-2026-19197, CVE-2026-19475, CVE-2026-21723, CVE-2026-2303, CVE-2026-33814, CVE-2026-39882, CVE-2026-41178, CVE-2026-41606, CVE-2026-42127, CVE-2026-56852, CVE-2026-73501, CVE-2026-8609, CVE-2026-9029

IAVB: 2026-B-0198-S

Detections

Analytics