openSUSE Ships Grafana Update Fixing Seventeen Flaws Including Auth Proxy Session Takeover
openSUSE has released advisory openSUSE-SU-2026:22125-1, rated important, which rebuilds Grafana for openSUSE Leap 16.0 to version 12.4.10 and resolves seventeen vulnerabilities together with seventeen bug fixes. The fixed package is grafana-12.4.10-bp160.1.1, and openSUSE Leap 16.0 is the only release listed as affected. The CVEs reach well beyond Grafana's bundled Go dependencies into its own authentication, dashboard and datasource handling, including a session takeover in the Auth Proxy and a fail-open authentication bypass. Among the dependency-level entries is CVE-2026-33814, the infinite-loop denial-of-service weakness in the golang.org/x/net HTTP/2 transport. Any Grafana instance installed from the openSUSE Leap 16.0 PackageHub repository at an earlier build is in scope.
The advisory describes each issue in a single line rather than publishing full exploitation detail, so the following reflects what the vendor has actually stated. The most consequential authentication defects are CVE-2026-14199, a session takeover caused by a cache key collision in Grafana's Auth Proxy, carrying a CVSS 3.1 score of 7.1, and CVE-2026-73501, a fail-open authentication bypass inherited from the github.com/getkin/kin-openapi library at 7.4. CVE-2026-17183 at 7.1 exposes data reachable through Grafana's configured datasource credentials, while CVE-2026-19197 at 6.3 is an access control failure in dashboard snapshots. Two cross-site scripting issues are fixed: CVE-2026-17033 at 6.8, a stored XSS delivered through an external Alertmanager generatorURL, and CVE-2026-9029 at 5.4, which the vendor describes as arbitrary code execution and information disclosure via XSS in the geomap panel. The remainder is a cluster of availability defects, including CVE-2026-42127 at 7.5 in the public dashboard query endpoint, CVE-2026-8609 at 5.3 in the pre-authentication OAuth login route, CVE-2026-19475 at 6.5 in the PostgreSQL datasource, CVE-2026-21723 at 5.3 in the Templates Test endpoint, and dependency-level fixes covering golang.org/x/text normalisation (CVE-2026-56852), OpenTelemetry OTLP HTTP exporters (CVE-2026-39882), opentelemetry-go baggage parsing (CVE-2026-41178), Apache Thrift (CVE-2026-41606), the cloudflare/circl library producing incorrect output for specific inputs (CVE-2026-1229), and the removal of the vulnerable go.mongodb.org/mongo-driver dependency (CVE-2026-2303).
Grafana matters disproportionately in this context because it sits at the junction between an organisation's monitoring stack and the systems it monitors. A single instance typically holds credentials for databases, cloud APIs and log platforms, which is precisely what CVE-2026-17183 touches, and many deployments are reachable from outside the network so that on-call staff and shared dashboards work. Several of the fixed flaws need no credentials at all: the public dashboard query endpoint, the OAuth login route and the HTTP/2 transport issue are all rated AV:N with PR:N, meaning a remote party can reach them without an account. The authentication bypass and the Auth Proxy cache collision are the entries most worth attention from an exposure standpoint, since both undermine identity rather than merely availability. On current exploitation status, none of these CVEs appear in CISA's Known Exploited Vulnerabilities catalogue and no in-the-wild activity is reported. FIRST EPSS places the thirty-day exploitation probability at 1.1 percent for CVE-2026-41606, 0.8 percent for CVE-2026-33814, 0.4 percent for CVE-2026-1229 and CVE-2026-19475, and between 0.2 and 0.3 percent for CVE-2026-14199, CVE-2026-17033, CVE-2026-17183, CVE-2026-19197, CVE-2026-21723, CVE-2026-2303, CVE-2026-39882 and CVE-2026-41178. No exploitation data was published for the remaining CVEs in the advisory, which is not the same as evidence that they are safe. The practical picture is a routine but broad maintenance release against an application that is often internet-facing and often over-privileged.
Attack Surface
Web Application, Supply Chain (Third-party vendors), Server OS
Tactics
Initial Access, Execution, Credential Access, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1059.007 – Command and Scripting Interpreter: JavaScript
- T1550 – Use Alternate Authentication Material
- T1499.004 – Endpoint Denial of Service: Application or System Exploitation
- T1552.001 – Unsecured Credentials: Credentials In Files
SuperPRO's Threat Countermeasures Procedures
- Install the openSUSE Leap 16.0 patch with 'zypper in -t patch openSUSE-Leap-16.0-packagehub-675=1' and verify the running package is grafana-12.4.10-bp160.1.1 or later, which carries all seventeen fixes in advisory openSUSE-SU-2026:22125-1.
- Check whether the [auth.proxy] section is enabled in grafana.ini on openSUSE Leap 16.0 hosts to scope exposure to CVE-2026-14199, the session takeover via Auth Proxy cache key collision, which is corrected only by the Grafana 12.4.10 rebuild delivered as grafana-12.4.10-bp160.1.1.
- Inventory the datasource definitions configured in each Grafana instance on openSUSE Leap 16.0, including PostgreSQL, MySQL, cloud and Loki connections, to scope exposure to CVE-2026-17183, which exposed data reachable through those configured credentials and is fixed in the 12.4.10 package.
- Disable public dashboards in Grafana configuration, or block external access to Grafana's public dashboard query endpoint at the fronting reverse proxy, until grafana-12.4.10-bp160.1.1 is installed, as CVE-2026-42127 is an unauthenticated memory-exhaustion denial of service against that endpoint rated CVSS 7.5.
- Apply connection rate limiting in front of Grafana's unauthenticated OAuth login route at the fronting nginx, HAProxy or ingress layer on hosts still running a pre-12.4.10 package, since CVE-2026-8609 is a pre-authentication denial of service reachable through that route.
- Identify Grafana instances on openSUSE Leap 16.0 where dashboard snapshots are in use, since the snapshot access control failure CVE-2026-19197 remains present on any build earlier than grafana-12.4.10-bp160.1.1 shipped in openSUSE-SU-2026:22125-1.
- Determine which Grafana instances use an external Alertmanager integration or the geomap panel, the delivery paths for the stored cross-site scripting issues CVE-2026-17033 and CVE-2026-9029, both of which are remediated by the Grafana 12.4.10 rebuild in openSUSE-SU-2026:22125-1.
