CVE-2025-12141

grafana: This update for grafana fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4....

CVE-2025-12141 is fixed in grafana on 1 platform, first by OPENSUSE-SU-2026:21351-1, released July 14, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
n/a
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0026
17th percentile

This update for grafana fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: - CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217) - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331) - CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187) - CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272) Breaking chahnges introduced in version 12.0.0: - BREAKING: Removed AngularJS and all deprecated UI Extensions APIs. - BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands. - BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs. Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512): - Add Legal-Review-Notice (bsc#1271327) - Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid - Analytics: Keep internal dashboard id. - Reporting: Correctly apply appSubURL to report settings requests - Alerting: Document Grafana HA Alertmanager cluster metrics prefix change. - Dependency updates to core plugins and UI libraries. - Updates to data source provisioning and dashboard schemas. - Introduced dynamic dashboards in public preview. - Added a new side toolbar that replaces the second top toolbar to provide additional vertical space. - Added the ability to create dashboards from templates using sample data. - Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers. - Added support to map one variable to multiple values. - Released a completely redesigned logs visualization. - Added the ability to export dashboards directly as PNG images. - Introduced an interactive learning experience within the Grafana UI. - Added a Switch template variable type to quickly toggle between values in queries. - Added functionality to style table cells using CSS properties via the field cell option. - Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials. - Redesigned the alert rule list page. - Renamed Mute Timings to Active Time Intervals in Grafana Alerting. - Added support for Service Account Impersonation in the BigQuery data source. - Introduced the Grafana Advisor in public preview. - Introduced a new dashboard schema to replace the original single grid layout. - MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

Where it's fixed

ProductFixed inFixReleased
Linux
grafana · opensuse-leap 16.0 12.4.5-bp160.1.1 OPENSUSE-SU-2026:21351-1 Jul 14, 2026
grafana · sles 15.7 12.4.5-150200.3.91.1 SUSE-SU-2026:3718-1 Aug 24, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.