{
  "fix": "OPENSUSE-SU-2026:22125-1",
  "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22125-1",
  "summary": "OPENSUSE-SU-2026:22125-1, released November 7, 2026, fixes 17 CVEs in grafana (version 12.4.10-bp160.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.",
  "platform": "linux",
  "type": "advisory",
  "title": "grafana security update",
  "released": "2026-11-07T00:47:19Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2026-17183, rated Critical",
  "supported": true,
  "cveCount": 17,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.01101,
  "maxCvss": 8.8,
  "vendorAdvisory": "https://osv.dev/vulnerability/openSUSE-SU-2026:22125-1",
  "appliesTo": [
    {
      "product": "grafana",
      "productUrl": "https://patchblox.com/security/product/linux/grafana",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "12.4.10-bp160.1.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-17183",
      "url": "https://patchblox.com/security/cve/CVE-2026-17183",
      "title": "grafana: Fix exposing data accessible through Grafana\u0027s",
      "priority": "Urgent",
      "severity": "CRITICAL",
      "cvss": 7.5,
      "epss": 0.00285,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-33814",
      "url": "https://patchblox.com/security/cve/CVE-2026-33814",
      "title": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.5,
      "epss": 0.0084,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-56852",
      "url": "https://patchblox.com/security/cve/CVE-2026-56852",
      "title": "Infinite loop on invalid input in golang.org/x/text",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.8,
      "epss": 0.00475,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-42127",
      "url": "https://patchblox.com/security/cve/CVE-2026-42127",
      "title": "grafana: Fix DoS through memory exhaustion in grafana\u0027a",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00432,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-8609",
      "url": "https://patchblox.com/security/cve/CVE-2026-8609",
      "title": "grafana: An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded mem...",
      "priority": "High",
      "severity": "moderate",
      "cvss": 7.4,
      "epss": 0.00397,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-41178",
      "url": "https://patchblox.com/security/cve/CVE-2026-41178",
      "title": "alloy: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS",
      "priority": "High",
      "severity": "important",
      "cvss": 8.2,
      "epss": 0.00336,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-41606",
      "url": "https://patchblox.com/security/cve/CVE-2026-41606",
      "title": "alloy: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 5.3,
      "epss": 0.01101,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-1229",
      "url": "https://patchblox.com/security/cve/CVE-2026-1229",
      "title": "alloy: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect",
      "priority": "Routine",
      "epss": 0.00426,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-73501",
      "url": "https://patchblox.com/security/cve/CVE-2026-73501",
      "title": "grafana: Fix fail-open authentication bypass in",
      "priority": "Routine",
      "epss": 0.00426,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-19475",
      "url": "https://patchblox.com/security/cve/CVE-2026-19475",
      "title": "grafana: Fix DoS in PostgreSQL Datasource (bsc#1278307)",
      "priority": "Routine",
      "epss": 0.00417,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-14199",
      "url": "https://patchblox.com/security/cve/CVE-2026-14199",
      "title": "grafana: Fix session takeover via Auth Proxy cache key",
      "priority": "Routine",
      "epss": 0.00325,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-2303",
      "url": "https://patchblox.com/security/cve/CVE-2026-2303",
      "title": "alloy: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling",
      "priority": "Routine",
      "epss": 0.00314,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-9029",
      "url": "https://patchblox.com/security/cve/CVE-2026-9029",
      "title": "grafana: Fix arbitrary code execution and information",
      "priority": "Routine",
      "epss": 0.00251,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-17033",
      "url": "https://patchblox.com/security/cve/CVE-2026-17033",
      "title": "grafana: Fix stored XSS via external Alertmanager",
      "priority": "Routine",
      "epss": 0.00218,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-21723",
      "url": "https://patchblox.com/security/cve/CVE-2026-21723",
      "title": "grafana: Fix DoS vulnerability in Templates Test",
      "priority": "Routine",
      "epss": 0.00215,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-39882",
      "url": "https://patchblox.com/security/cve/CVE-2026-39882",
      "title": "OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.3,
      "epss": 0.00199,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-19197",
      "url": "https://patchblox.com/security/cve/CVE-2026-19197",
      "title": "grafana: Fix access control in dashboard snapshots",
      "priority": "Routine",
      "epss": 0.00154,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}