# CVE-2026-8595: grafana: This update for grafana, system-user-grafana fixes the following issues:  - Update to version 12.4.10:   * Security:...

CVE-2026-8595 is fixed in 2 products on 1 platform, first by OPENSUSE-SU-2026:21366-1, released July 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-8595
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 17, 2026

## Description

This update for grafana, system-user-grafana fixes the following issues:  - Update to version 12.4.10:   * Security:     CVE-2026-17183: Fix exposing data accessible through Grafana's                     configured datasource credentials (bsc#1275934)     CVE-2026-2303: Drop dependency on vulnerable                    go.mongodb.org/mongo-driver (bsc#1269841)     CVE-2026-17033: Fix stored XSS via external Alertmanager                     generatorURL (bsc#1276426)     CVE-2026-73501: Fix fail-open authentication bypass in                     github.com/getkin/kin-openapi (bsc#1276973)     CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)     CVE-2026-14199: Fix session takeover via Auth Proxy cache key                     collision (bsc#1278322)   * Bug fixes:     Dashboards: Fix adhoc and groupby variable datasource on UI                 import     Dashboards: Fix version dates and user display names in the                 legacy version history page - Update to version 12.4.9:   * Features and enhancements:     Dashboard Import: Labels in v2 schema   * Bug fixes:     Azure Monitor: fix migration for dimension filters - Update to version 12.4.8:   * Security:     CVE-2026-19197: Fix access control in dashboard snapshots                     (bsc#1277025) - Update to version 12.4.7:   * Security:     CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8                     input in golang.org/x/text/unicode/norm                     (bsc#1272008)   * Features and enhancements:     Dashboards: Get annotations and dashboard endpoint performance                 improvements   * Bug fixes:     DashboardDS: Fix Mixed panels with a time override stuck in                  permanent loading - Update to version 12.4.6:   * Security:     CVE-2026-41178: Fix opentelemetry-go's baggage parsing                     (bsc#1276658)   * Features and enhancements:     Alerting: Add protected fields authorization check to               provisioning API     Alerting: Return 403 instead of 500 on contact point provenance               mismatch   * Bug fixes:     Jaeger: Handle gzip, deflate, and brotli compressed API             responses     Alerting: fix ORM table mapping bug causing SELECT alert_rule               columns FROM user on PostgreSQL - Drop 0005-Bump-edwards25519.patch      CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry                     OTLP HTTP exporters by updating to v1.43.0.                     (bsc#1274217)     CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)     CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a                     public dashboard query endpoint (bsc#1268868)     CVE-2026-9029: Fix arbitrary code execution and information                    disclosure via XSS in geomap panel (bsc#1272328)     CVE-2026-33814: Fix infinite loop in HTTP/2 transport by                     updating golang.org/x/net (bsc#1265763)     CVE-2026-8609: Fix pre-authentication DoS in the OAuth login                    route (bsc#1271330)   * CVE-2026-1229: Update github.com/cloudflare/circl to fix                    producing incorect output for specific inputs                    (bsc#1265525)                     (bsc#1262187)   * CVE-2026-21723: Fix DoS vulnerability in Templates Test                     endpoint (bsc#1272427) - CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330) - Build only for SUSE distributions

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | grafana opensuse-leap 16.0 | 12.4.5-bp160.2.1 | [OPENSUSE-SU-2026:21366-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21366-1.md) | Jul 17, 2026 |
| Linux | grafana sles 15.7 | 12.4.10-150200.3.94.3 | [SUSE-SU-2026:4600-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4600-1.md) | Nov 7, 2026 |
| Linux | system-user-grafana sles 15.7 | 1.0.0-150200.5.8.1 | [SUSE-SU-2026:4600-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4600-1.md) | Nov 7, 2026 |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.