CVE-2026-27877
Fixed in a distro release EPSS <1%CVSS 6.5
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Products: grafana, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | no fix |
| Go | github.com/grafana/grafana | 1.9.2-0.20260325055210-3522153e07b4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | grafana | 10.2.6-26.el10_2 |
| AlmaLinux 10 | grafana | 10.2.6-24.el10_1 |
| AlmaLinux 10 | grafana-selinux | 10.2.6-24.el10_1 |
| AlmaLinux 10 | grafana-selinux | 10.2.6-26.el10_2 |
| AlmaLinux 9 | grafana | 10.2.6-22.el9_8 |
| AlmaLinux 9 | grafana | 10.2.6-20.el9_7 |
| AlmaLinux 9 | grafana-selinux | 10.2.6-22.el9_8 |
| AlmaLinux 9 | grafana-selinux | 10.2.6-20.el9_7 |
| Chainguard | grafana-11.5 | no fix |
| Chainguard | grafana-11.6 | 0 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | 0 |
| Chainguard | grafana-12.2 | 0 |
| Chainguard | grafana-12.3 | 0 |
| Chainguard | grafana-fips-11.5 | no fix |
| Chainguard | grafana-fips-11.6 | 11.6.14-r2 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r0 |
| Chainguard | grafana-fips-12.2 | 12.2.8.01-r0 |
| Chainguard | grafana-fips-12.3 | 12.3.6.01-r0 |
| Chainguard | grafana-fips-12.4 | 12.4.5-r2 |
| Chainguard | grafana-fips-13.0 | 13.0.3-r3 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Red Hat Enterprise Linux 10.1 | grafana | 0:10.2.6-24.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-debuginfo | 0:10.2.6-24.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-debugsource | 0:10.2.6-24.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-selinux | 0:10.2.6-24.el10_1 |
| Red Hat Enterprise Linux 10.2 | grafana | 0:10.2.6-26.el10_2 |
| Red Hat Enterprise Linux 10.2 | grafana-debuginfo | 0:10.2.6-26.el10_2 |
| Red Hat Enterprise Linux 10.2 | grafana-debugsource | 0:10.2.6-26.el10_2 |
| Red Hat Enterprise Linux 10.2 | grafana-selinux | 0:10.2.6-26.el10_2 |
| Red Hat Enterprise Linux 9 | grafana | 0:10.2.6-22.el9_8 |
| Red Hat Enterprise Linux 9 | grafana | 0:10.2.6-20.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-debuginfo | 0:10.2.6-22.el9_8 |
| Red Hat Enterprise Linux 9 | grafana-debuginfo | 0:10.2.6-20.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-debugsource | 0:10.2.6-22.el9_8 |
| Red Hat Enterprise Linux 9 | grafana-debugsource | 0:10.2.6-20.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-selinux | 0:10.2.6-20.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-selinux | 0:10.2.6-22.el9_8 |
| Red Hat Enterprise Linux eus 10.0 | grafana | 0:10.2.6-23.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debuginfo | 0:10.2.6-23.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debugsource | 0:10.2.6-23.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-selinux | 0:10.2.6-23.el10_0 |
| Red Hat rhel eus 9.6 | grafana | 0:10.2.6-20.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debuginfo | 0:10.2.6-20.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debugsource | 0:10.2.6-20.el9_6 |
| Red Hat rhel eus 9.6 | grafana-selinux | 0:10.2.6-20.el9_6 |
| Rocky Linux 10 | grafana | 0:10.2.6-24.el10_1 |
| Rocky Linux 10 | grafana | 0:10.2.6-26.el10_2 |
| Rocky Linux 9 | grafana | 0:10.2.6-22.el9_8 |
| Rocky Linux 9 | grafana | 0:10.2.6-20.el9_7 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.0-150002.3.8.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security01-150002.4.14.1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.1.13-150002.3.9.3 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.26-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.26-150002.3.12.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| Wolfi | grafana-12.1 | 0 |
| Wolfi | grafana-12.2 | 0 |
| Wolfi | grafana-12.3 | 0 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Leap 16.0 | grafana | 11.6.14+security04-bp160.1.1 |
| openSUSE Tumbleweed | grafana | 11.6.14+security01-1.1 |