There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl
    greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity
    attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who
    shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is
    live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
    (CVE-2026-14199)

  - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the
    InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay
    protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session
    as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this
    setting is off by default and Grafana OSS is not affected. (CVE-2026-12704)

  - An authenticated user can list alert rules stored in folders they are not allowed to read through the
    alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction
    was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can
    trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not
    exposed. (CVE-2026-13719)

  - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and
    grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these
    fields were stored without an authorization check. The dashboard then appears file-provisioned, and
    administrators can no longer update or delete it through Grafana. The impact is limited to the same
    organization and no data is exposed. (CVE-2026-13720)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98541 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99134 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99151 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:98541 advisory.

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_98541 advisory.

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98639 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: Azure Monitor data source could leak its Azure access token (CVE-2026-88967)

    * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed     input (CVE-2026-116591)

    * grafana: Grafana: Information disclosure via legacy schema switch in contact points (CVE-2026-100105)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an     attacker-controlled endpoint that disclose the data source's Azure access token (server-side request     forgery). (CVE-2026-88967)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/11/5	2026/11/5	high
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/11/5	2026/11/5	high
378829	RHEL 9 : grafana (RHSA-2026:98541)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/12	high
379363	RHEL 10 : grafana (RHSA-2026:99134)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/13	high
379408	RHEL 9 : grafana (RHSA-2026:99151)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/13	high
380693	RockyLinux 9 : grafana (RLSA-2026:98541)	Nessus	Rocky Linux Local Security Checks	2026/11/13	2026/11/13	high
381087	Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_98541)	Nessus	Rocky Linux Local Security Checks	2026/11/14	2026/11/14	high
378817	RHEL 10 : grafana (RHSA-2026:98639)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/12	high
373851	Linux Distros Unpatched Vulnerability : CVE-2026-88967	Nessus	Misc.	2026/10/29	2026/11/13	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high