RHSA-2026:58982MediumCVSS 7.4

Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Published
August 24, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-33376 →CVE-2026-33377 →

📋 Description

CVE-2026-33376 — grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default CVE-2026-33377 — grafana: Grafana: Privilege escalation via dashboard overwrite

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-0:10.2.6-23.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-0:10.2.6-23.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-0:10.2.6-23.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-0:10.2.6-23.el9_8.2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-0:10.2.6-23.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debuginfo-0:10.2.6-23.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debuginfo-0:10.2.6-23.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debuginfo-0:10.2.6-23.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debuginfo-0:10.2.6-23.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debugsource-0:10.2.6-23.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debugsource-0:10.2.6-23.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debugsource-0:10.2.6-23.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-debugsource-0:10.2.6-23.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-selinux-0:10.2.6-23.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-selinux-0:10.2.6-23.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-selinux-0:10.2.6-23.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • grafana-selinux-0:10.2.6-23.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, explicitly specify the intended IPv6 address mask—typically /128 for a single host—within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended. For RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect. Workaround: Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them.

🔗 References (7)