grafana: This update for grafana fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4....
CVE-2026-28380 is fixed in grafana on 1 platform, first by OPENSUSE-SU-2026:20940-1, released June 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.
This update for grafana fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: - CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217) - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331) - CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187) - CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272) Breaking chahnges introduced in version 12.0.0: - BREAKING: Removed AngularJS and all deprecated UI Extensions APIs. - BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands. - BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs. Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512): - Add Legal-Review-Notice (bsc#1271327) - Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid - Analytics: Keep internal dashboard id. - Reporting: Correctly apply appSubURL to report settings requests - Alerting: Document Grafana HA Alertmanager cluster metrics prefix change. - Dependency updates to core plugins and UI libraries. - Updates to data source provisioning and dashboard schemas. - Introduced dynamic dashboards in public preview. - Added a new side toolbar that replaces the second top toolbar to provide additional vertical space. - Added the ability to create dashboards from templates using sample data. - Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers. - Added support to map one variable to multiple values. - Released a completely redesigned logs visualization. - Added the ability to export dashboards directly as PNG images. - Introduced an interactive learning experience within the Grafana UI. - Added a Switch template variable type to quickly toggle between values in queries. - Added functionality to style table cells using CSS properties via the field cell option. - Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials. - Redesigned the alert rule list page. - Renamed Mute Timings to Active Time Intervals in Grafana Alerting. - Added support for Service Account Impersonation in the BigQuery data source. - Introduced the Grafana Advisor in public preview. - Introduced a new dashboard schema to replace the original single grid layout. - MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| grafana · opensuse-leap 16.0 | 11.6.14+security04-bp160.1.1 | OPENSUSE-SU-2026:20940-1 | Jun 10, 2026 |
| grafana · sles 15.7 | 12.4.5-150200.3.91.1 | SUSE-SU-2026:3718-1 | Aug 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.