{
  "cveId": "CVE-2026-8595",
  "url": "https://patchblox.com/security/cve/CVE-2026-8595",
  "summary": "CVE-2026-8595 is fixed in 2 products on 1 platform, first by OPENSUSE-SU-2026:21366-1, released July 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "grafana: This update for grafana, system-user-grafana fixes the following issues:\n\n- Update to version 12.4.10:\n  * Security:...",
  "description": "This update for grafana, system-user-grafana fixes the following issues:\n\n- Update to version 12.4.10:\n  * Security:\n    CVE-2026-17183: Fix exposing data accessible through Grafana\u0027s\n                    configured datasource credentials (bsc#1275934)\n    CVE-2026-2303: Drop dependency on vulnerable\n                   go.mongodb.org/mongo-driver (bsc#1269841)\n    CVE-2026-17033: Fix stored XSS via external Alertmanager\n                    generatorURL (bsc#1276426)\n    CVE-2026-73501: Fix fail-open authentication bypass in\n                    github.com/getkin/kin-openapi (bsc#1276973)\n    CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)\n    CVE-2026-14199: Fix session takeover via Auth Proxy cache key\n                    collision (bsc#1278322)\n  * Bug fixes:\n    Dashboards: Fix adhoc and groupby variable datasource on UI\n                import\n    Dashboards: Fix version dates and user display names in the\n                legacy version history page\n- Update to version 12.4.9:\n  * Features and enhancements:\n    Dashboard Import: Labels in v2 schema\n  * Bug fixes:\n    Azure Monitor: fix migration for dimension filters\n- Update to version 12.4.8:\n  * Security:\n    CVE-2026-19197: Fix access control in dashboard snapshots\n                    (bsc#1277025)\n- Update to version 12.4.7:\n  * Security:\n    CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8\n                    input in golang.org/x/text/unicode/norm\n                    (bsc#1272008)\n  * Features and enhancements:\n    Dashboards: Get annotations and dashboard endpoint performance\n                improvements\n  * Bug fixes:\n    DashboardDS: Fix Mixed panels with a time override stuck in\n                 permanent loading\n- Update to version 12.4.6:\n  * Security:\n    CVE-2026-41178: Fix opentelemetry-go\u0027s baggage parsing\n                    (bsc#1276658)\n  * Features and enhancements:\n    Alerting: Add protected fields authorization check to\n              provisioning API\n    Alerting: Return 403 instead of 500 on contact point provenance\n              mismatch\n  * Bug fixes:\n    Jaeger: Handle gzip, deflate, and brotli compressed API\n            responses\n    Alerting: fix ORM table mapping bug causing SELECT alert_rule\n              columns FROM user on PostgreSQL\n- Drop 0005-Bump-edwards25519.patch\n\n    CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry\n                    OTLP HTTP exporters by updating to v1.43.0.\n                    (bsc#1274217)\n    CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)\n    CVE-2026-42127: Fix DoS through memory exhaustion in grafana\u0027a\n                    public dashboard query endpoint (bsc#1268868)\n    CVE-2026-9029: Fix arbitrary code execution and information\n                   disclosure via XSS in geomap panel (bsc#1272328)\n    CVE-2026-33814: Fix infinite loop in HTTP/2 transport by\n                    updating golang.org/x/net (bsc#1265763)\n    CVE-2026-8609: Fix pre-authentication DoS in the OAuth login\n                   route (bsc#1271330)\n  * CVE-2026-1229: Update github.com/cloudflare/circl to fix\n                   producing incorect output for specific inputs\n                   (bsc#1265525)\n                    (bsc#1262187)\n  * CVE-2026-21723: Fix DoS vulnerability in Templates Test\n                    endpoint (bsc#1272427)\n- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)\n- Build only for SUSE distributions",
  "published": "2026-07-17T10:42:53Z",
  "severity": "",
  "epss": 0.0024,
  "epssPercentile": 0.15132,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "grafana",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "12.4.5-bp160.2.1",
      "fix": "OPENSUSE-SU-2026:21366-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21366-1",
      "released": "2026-07-17T10:42:53Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "sles 15.7",
      "fixedVersion": "12.4.10-150200.3.94.3",
      "fix": "SUSE-SU-2026:4600-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4600-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "system-user-grafana",
      "release": "sles 15.7",
      "fixedVersion": "1.0.0-150200.5.8.1",
      "fix": "SUSE-SU-2026:4600-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4600-1",
      "released": "2026-11-07T00:43:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}