# CVE-2026-27876: grafana: This update for grafana fixes the following issues:  Changes in grafana:  - CVE-2026-39821: Fix validation bypass and...

CVE-2026-27876 is fixed in grafana on 1 platform by OPENSUSE-SU-2026:20940-1 (version 11.6.14+security04-bp160.1.1), released June 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-27876
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0196
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 10, 2026

## Description

This update for grafana fixes the following issues:  Changes in grafana:  - CVE-2026-39821: Fix validation bypass and privilege escalation by   updating golang.org/x/net to version 0.55.0 (bsc#1266600)  - Update to version 11.6.14+security-04:   Security:   * CVE-2026-28374: Fix insecure direct object reference in     Annotations API (bsc#1265290)   * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live     push endpoint (bsc#1265289)   * CVE-2026-28383: Fix unbounded memory allocation in Grafana     plugin resources (bsc#1265286)   * CVE-2026-28380: Fix broken access control in Snapshot API     (bsc#1265287)   * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass     (bsc#1265285)   * CVE-2026-28379: Fix viewer-triggered race condition in     Grafana Live (bsc#1265288)   * CVE-2026-33377: Fix dashboard Editor Privilege Escalation     (bsc#1265284)   * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin     (bsc#1265283)   * CVE-2026-33381: Prevent users from generating Service Account     tokens after permissions removal (bsc#1265281)   * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing     an authenticated attacker to read arbitrary files from the     Grafana server’s filesystem (bsc#1265282)  - CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950) - CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability   in Apache Thrift (bsc#1263501)  - CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1   (bsc#1258595) - CVE-2026-21725: Fix missing UID when deleting datasource by name   (bsc#1258873)  - Update to version 11.6.14+security-01:   Security:   * CVE-2026-33375: Fix denial of Service via out-of-memory     exhaustion in MSSQL data source plugin (bsc#1260881)  - Update to version 11.6.14:   Security:   * CVE-2026-27876: Fix remote arbitrary code execution via chained     SQL Expressions (bsc#1261025)   * CVE-2026-27877: Fix information disclosure of data-source     passwords via public dashboards (bsc#1261026)   * CVE-2026-28375: Fix denial of service via testdata data-source     (bsc#1261029)   * CVE-2026-27879: Fix denial of service via resample query     (bsc#1261027)   * CVE-2026-33186: Fix authorization bypass due to improper     validation of the HTTP/2 :path pseudo-header (bsc#1260263)   * CVE-2026-21724: Fix authorization bypass allows modification of     protected webhook URLs (bsc#1260878)  - Update to version 11.6.13:   Enhancement:   * Wire the public dashboard service to the HTTP server  - Update to version 11.6.12:   Enhancement:   * Update authentication redirect logic   Bug fix:   * Fix single panel render with variable references

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | grafana opensuse-leap 16.0 | 11.6.14+security04-bp160.1.1 | [OPENSUSE-SU-2026:20940-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20940-1.md) | Jun 10, 2026 |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.