{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "grafana-11.6.14+security01-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10601",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10601-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21720 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21721 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21721/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21722 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21722/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21724 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21724/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21725 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21725/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26958 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26958/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27876 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27876/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27877 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27879 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27879/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-28375 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-28375/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33375 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33375/"
      }
    ],
    "title": "grafana-11.6.14+security01-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-22T00:00:00Z",
      "generator": {
        "date": "2026-04-22T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10601-1",
      "initial_release_date": "2026-04-22T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-22T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security01-1.1.aarch64",
                "product": {
                  "name": "grafana-11.6.14+security01-1.1.aarch64",
                  "product_id": "grafana-11.6.14+security01-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security01-1.1.ppc64le",
                "product": {
                  "name": "grafana-11.6.14+security01-1.1.ppc64le",
                  "product_id": "grafana-11.6.14+security01-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security01-1.1.s390x",
                "product": {
                  "name": "grafana-11.6.14+security01-1.1.s390x",
                  "product_id": "grafana-11.6.14+security01-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.14+security01-1.1.x86_64",
                "product": {
                  "name": "grafana-11.6.14+security01-1.1.x86_64",
                  "product_id": "grafana-11.6.14+security01-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security01-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64"
        },
        "product_reference": "grafana-11.6.14+security01-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security01-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le"
        },
        "product_reference": "grafana-11.6.14+security01-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security01-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x"
        },
        "product_reference": "grafana-11.6.14+security01-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.14+security01-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        },
        "product_reference": "grafana-11.6.14+security01-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-21720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21720",
          "url": "https://www.suse.com/security/cve/CVE-2026-21720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257349 for CVE-2026-21720",
          "url": "https://bugzilla.suse.com/1257349"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-21720"
    },
    {
      "cve": "CVE-2026-21721",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21721"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization-internal privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21721",
          "url": "https://www.suse.com/security/cve/CVE-2026-21721"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257337 for CVE-2026-21721",
          "url": "https://bugzilla.suse.com/1257337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-21721"
    },
    {
      "cve": "CVE-2026-21722",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21722"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21722",
          "url": "https://www.suse.com/security/cve/CVE-2026-21722"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258136 for CVE-2026-21722",
          "url": "https://bugzilla.suse.com/1258136"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21722"
    },
    {
      "cve": "CVE-2026-21724",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21724"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21724",
          "url": "https://www.suse.com/security/cve/CVE-2026-21724"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260878 for CVE-2026-21724",
          "url": "https://bugzilla.suse.com/1260878"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21724"
    },
    {
      "cve": "CVE-2026-21725",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21725"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21725",
          "url": "https://www.suse.com/security/cve/CVE-2026-21725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258873 for CVE-2026-21725",
          "url": "https://bugzilla.suse.com/1258873"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-21725"
    },
    {
      "cve": "CVE-2026-26958",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26958"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26958",
          "url": "https://www.suse.com/security/cve/CVE-2026-26958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258570 for CVE-2026-26958",
          "url": "https://bugzilla.suse.com/1258570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26958"
    },
    {
      "cve": "CVE-2026-27876",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27876"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.\n\nOnly instances with the sqlExpressions feature toggle enabled are vulnerable.\n\nOnly instances in the following version ranges are affected:\n\n- 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected.\n- 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life.\n- 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix.\n- 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix.\n- 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27876",
          "url": "https://www.suse.com/security/cve/CVE-2026-27876"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261025 for CVE-2026-27876",
          "url": "https://bugzilla.suse.com/1261025"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-27876"
    },
    {
      "cve": "CVE-2026-27877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When using public dashboards and direct data-sources, all direct data-sources\u0027 passwords are exposed despite not being used in dashboards.\n\nNo passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments\u0027 security.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27877",
          "url": "https://www.suse.com/security/cve/CVE-2026-27877"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261026 for CVE-2026-27877",
          "url": "https://bugzilla.suse.com/1261026"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27877"
    },
    {
      "cve": "CVE-2026-27879",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27879"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A resample query can be used to trigger out-of-memory crashes in Grafana.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27879",
          "url": "https://www.suse.com/security/cve/CVE-2026-27879"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261027 for CVE-2026-27879",
          "url": "https://bugzilla.suse.com/1261027"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27879"
    },
    {
      "cve": "CVE-2026-28375",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-28375"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A testdata data-source can be used to trigger out-of-memory crashes in Grafana.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-28375",
          "url": "https://www.suse.com/security/cve/CVE-2026-28375"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261029 for CVE-2026-28375",
          "url": "https://bugzilla.suse.com/1261029"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-28375"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33375",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33375"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
          "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33375",
          "url": "https://www.suse.com/security/cve/CVE-2026-33375"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260881 for CVE-2026-33375",
          "url": "https://bugzilla.suse.com/1260881"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.aarch64",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.ppc64le",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.s390x",
            "openSUSE Tumbleweed:grafana-11.6.14+security01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33375"
    }
  ]
}