There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl
    greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity
    attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who
    shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is
    live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
    (CVE-2026-14199)

  - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the
    InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay
    protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session
    as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this
    setting is off by default and Grafana OSS is not affected. (CVE-2026-12704)

  - An authenticated user can list alert rules stored in folders they are not allowed to read through the
    alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction
    was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can
    trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not
    exposed. (CVE-2026-13719)

  - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and
    grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these
    fields were stored without an authorization check. The dashboard then appears file-provisioned, and
    administrators can no longer update or delete it through Grafana. The impact is limited to the same
    organization and no data is exposed. (CVE-2026-13720)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 具有 Git 同步 （佈建） 連線唯讀存取權的使用者或服務帳戶可以透過其狀態子資源 （授權不正確） 修改連線的設定。在 Grafana 12.4 上，受影響的 API 只有在啟用實驗性佈建功能切換時才可用。
    (CVE-2026-15577)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 对 Git Sync（配置）连接具有只读访问权限的用户或服务帐户可通过其状态子资源修改连接的配置（不正确的授权）。在 Grafana 12.4 上，仅当启用了实验性设置功能切换时，受影响的 API 才可用。
    (CVE-2026-15577)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Git Sync (プロビジョニング) 接続への読み取り専用アクセス権を持つユーザーまたはサービスアカウントは、ステータスサブリソース (不適切な承認) を使用して接続の設定を変更できます。Grafana 12.4 では、影響を受けるAPIは、試験的なプロビジョニング機能トグルが有効になっている場合にのみ利用できます。
    (CVE-2026-15577)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user or service account with read-only access to Git Sync (provisioning) connections can modify a     connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the     affected API is only available when the experimental provisioning feature toggle is enabled.
    (CVE-2026-15577)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/5/2026	11/5/2026	high
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/5/2026	11/5/2026	high
369444	Linux Distros 未修補弱點：CVE-2026-15577	Nessus	Misc.	10/21/2026	11/6/2026	medium
369444	Linux Distros 未修补的漏洞：CVE-2026-15577	Nessus	Misc.	10/21/2026	11/6/2026	medium
369444	Linux Distros のパッチ未適用の脆弱性: CVE-2026-15577	Nessus	Misc.	10/21/2026	11/6/2026	medium
369444	Linux Distros Unpatched Vulnerability : CVE-2026-15577	Nessus	Misc.	10/21/2026	11/6/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium