The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory.

    - Update to version 12.4.10:
      * Security:
        CVE-2026-17183: Fix exposing data accessible through Grafana's                         configured datasource credentials (bsc#1275934)         CVE-2026-2303: Drop dependency on vulnerable                        go.mongodb.org/mongo-driver (bsc#1269841)         CVE-2026-17033: Fix stored XSS via external Alertmanager                         generatorURL (bsc#1276426)         CVE-2026-73501: Fix fail-open authentication bypass in                         github.com/getkin/kin-openapi (bsc#1276973)         CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)         CVE-2026-14199: Fix session takeover via Auth Proxy cache key                         collision (bsc#1278322)
      * Bug fixes:
        Dashboards: Fix adhoc and groupby variable datasource on UI                     import         Dashboards: Fix version dates and user display names in the                     legacy version history page
    - Update to version 12.4.9:
      * Features and enhancements:
        Dashboard Import: Labels in v2 schema
      * Bug fixes:
        Azure Monitor: fix migration for dimension filters
    - Update to version 12.4.8:
      * Security:
        CVE-2026-19197: Fix access control in dashboard snapshots                         (bsc#1277025)
    - Update to version 12.4.7:
      * Security:
        CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8                         input in golang.org/x/text/unicode/norm                         (bsc#1272008)
      * Features and enhancements:
        Dashboards: Get annotations and dashboard endpoint performance                     improvements
      * Bug fixes:
        DashboardDS: Fix Mixed panels with a time override stuck in                      permanent loading
    - Update to version 12.4.6:
      * Security:
        CVE-2026-41178: Fix opentelemetry-go's baggage parsing                         (bsc#1276658)
      * Features and enhancements:
        Alerting: Add protected fields authorization check to                   provisioning API         Alerting: Return 403 instead of 500 on contact point provenance                   mismatch
      * Bug fixes:
        Jaeger: Handle gzip, deflate, and brotli compressed API                 responses         Alerting: fix ORM table mapping bug causing SELECT alert_rule                   columns FROM user on PostgreSQL
    - Drop 0005-Bump-edwards25519.patch

        CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry                         OTLP HTTP exporters by updating to v1.43.0.
                        (bsc#1274217)         CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)         CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a                         public dashboard query endpoint (bsc#1268868)         CVE-2026-9029: Fix arbitrary code execution and information                        disclosure via XSS in geomap panel (bsc#1272328)         CVE-2026-33814: Fix infinite loop in HTTP/2 transport by                         updating golang.org/x/net (bsc#1265763)         CVE-2026-8609: Fix pre-authentication DoS in the OAuth login                        route (bsc#1271330)
      * CVE-2026-1229: Update github.com/cloudflare/circl to fix                        producing incorect output for specific inputs                        (bsc#1265525)                         (bsc#1262187)
      * CVE-2026-21723: Fix DoS vulnerability in Templates Test                         endpoint (bsc#1272427)
    - CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
    - Build only for SUSE distributions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1004 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-19197:
    A user with organization administrator permissions can delete dashboard snapshots belonging to other     organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its     public share key (broken access control).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory.

    Changes in grafana:

    Update to version 12.4.10:

      * Security:

        * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials     (bsc#1275934)
        * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
        * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
        * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
        * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
        * CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

      * Bug fixes:

        * Dashboards: Fix adhoc and groupby variable datasource on UI import
        * Dashboards: Fix version dates and user display names in the legacy version history page

    Update to version 12.4.9:

      * Features and enhancements:

        * Dashboard Import: Labels in v2 schema

      * Bug fixes:

        * Azure Monitor: fix migration for dimension filters

    Update to version 12.4.8:

      * Security:

        * CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

    Update to version 12.4.7:

      * Security:

        * CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm     (bsc#1272008)

      * Features and enhancements:

        * Dashboards: Get annotations and dashboard endpoint performance improvements

      * Bug fixes:

        * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

    Update to version 12.4.6:

      * Security:

        * CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

      * Features and enhancements:

        * Alerting: Add protected fields authorization check to provisioning API
        * Alerting: Return 403 instead of 500 on contact point provenance mismatch

      * Bug fixes:

        * Jaeger: Handle gzip, deflate, and brotli compressed API responses
        * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

    * CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to     v1.43.0.  (bsc#1274217)
    * CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint     (bsc#1268868)
    * CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel     (bsc#1272328)
    * CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)
    * CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)
    * CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs     (bsc#1265525) (bsc#1262187)
    * CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)
    * CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user with organization administrator permissions can delete dashboard snapshots belonging to other     organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its     public share key (broken access control). (CVE-2026-19197)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
369265	SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)	Nessus	SuSE Local Security Checks	10/21/2026	10/21/2026	medium
346452	TencentOS Server 4: grafana (TSSA-2026:1004)	Nessus	Tencent Local Security Checks	9/16/2026	9/16/2026	medium
370424	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)	Nessus	SuSE Local Security Checks	10/22/2026	10/22/2026	medium
341925	Linux Distros Unpatched Vulnerability : CVE-2026-19197	Nessus	Misc.	8/31/2026	11/5/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium