{
  "cveId": "CVE-2026-28375",
  "url": "https://patchblox.com/security/cve/CVE-2026-28375",
  "summary": "CVE-2026-28375 is fixed in grafana on 1 platform by OPENSUSE-SU-2026:20940-1 (version 11.6.14\u002Bsecurity04-bp160.1.1), released June 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "grafana: This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and...",
  "description": "This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14\u002Bsecurity-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server\u2019s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14\u002Bsecurity-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references",
  "published": "2026-06-10T12:02:03Z",
  "severity": "",
  "epss": 0.0039,
  "epssPercentile": 0.33455,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "grafana",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "11.6.14\u002Bsecurity04-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:20940-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20940-1",
      "released": "2026-06-10T12:02:03Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}