{
  "cveId": "CVE-2026-21722",
  "url": "https://patchblox.com/security/cve/CVE-2026-21722",
  "summary": "CVE-2026-21722 is fixed in 8 products on 1 platform, first by SUSE-SU-2026:1013-1, released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "golang-github-prometheus-promu: This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to...",
  "description": "This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to 3 times (bsc#1253004)\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization and update\n\ngolang-github-boynux-squid_exporter:\n\n- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):\n\n  * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path\n  * Added TLS and Basic Authentication to the exporter\u2019s web interface\n  * Added support for the exporter to authenticate against the Squid proxy itself\n  * Allow the gathering of process information without requiring root privileges\n  * The exporter can now be configured using environment variables\n  * Added support for custom labels to all exported metrics for better data filtering\n  * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred\n  * Added \u0027service time\u0027 metrics to analyze proxy speed and performance.\n  * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks\n  * Corrected the squid_client_http_requests_total metric to ensure accurate reporting\n\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Version update from 1.0.8 to 1.0.10:\n\n  * Updated github.com/prometheus/client_golang to 1.21.1\n  * Updated github.com/prometheus/common to 0.63.0\n  * Updated github.com/prometheus/exporter-toolkit to 0.14.0\n  * Fixed signal handler logging\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren\u0027t reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times\n\ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n  * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:\n \n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: Resolved bugs involving row repeats and \u0027self-referencing\u0027 data links\n  * Alerting Fixes: Patched a critical \u0027panic\u0027 (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren\u0027t working correctly\n  * URL Handling: Fixed a bug where \u0027true\u0027 values in URL parameters weren\u0027t being read correctly\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version update to 5.0.15:\n\n  * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to integer values (bsc#1251995)\n  * Fixed spacecmd binary file upload (bsc#1253659)\n\nuyuni-tools:\n\n- Version update to 0.1.38:\n\n  * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Ignore supportconfig errors (bsc#1255781)\n  * Bumped the default image tag to 5.0.7\n  * Removed cgroup mount for podman containers (bsc#1253347)\n  * Registry flag can be a string (bsc#1254589)\n  * Use static supportconfig name to avoid dynamic search (bsc#1257941)",
  "published": "2026-03-25T10:11:52Z",
  "severity": "",
  "epss": 0.00358,
  "epssPercentile": 0.29788,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dracut-saltboot",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.1.0-150000.1.65.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-QubitProducts-exporter_exporter",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.4.0-150000.1.21.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-boynux-squid_exporter",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.13.0-150000.1.12.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-lusitaniae-apache_exporter",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.0.10-150000.1.26.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-promu",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.17.0-150000.3.30.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-promu",
      "release": "sles 15.7",
      "fixedVersion": "0.17.0-150000.3.30.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "11.6.11-150200.3.83.1",
      "fix": "SUSE-SU-2026:1037-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1037-1",
      "released": "2026-03-25T10:31:04Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "sles 15.7",
      "fixedVersion": "11.6.11-150200.3.83.1",
      "fix": "SUSE-SU-2026:1037-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1037-1",
      "released": "2026-03-25T10:31:04Z"
    },
    {
      "platform": "linux",
      "product": "prometheus-blackbox_exporter",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.26.0-150000.1.30.2",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    },
    {
      "platform": "linux",
      "product": "spacecmd",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.0.15-150000.3.142.1",
      "fix": "SUSE-SU-2026:1013-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1013-1",
      "released": "2026-03-25T10:11:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}