Vulnerability-Lookup

CVE-2026-21728 (GCVE-0-2026-21728)

Vulnerability from cvelistv5 – Published: 2026-04-24 08:00 – Updated: 2026-08-27 17:22

Title

Tempo query limit results in unbounded memory allocation

Summary

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-24 11:29 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

9 references

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-21728	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461395	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:22423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21769	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24503	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22347	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23345	vendor-advisoryx_refsource_REDHAT

Impacted products

16 products

Vendor	Product	Version	CPE status
Grafana	Tempo	Affected: 1.3.0 , ≤ 2.8.3 (semver) Affected: 2.9.0 , ≤ 2.9.1 (semver) Affected: 2.10.0 , ≤ 2.10.1 (semver)	guessed
Grafana	Enterprise Traces (GET)	Affected: 1.0.0 , ≤ 2.8.7 (semver)	guessed
Red Hat	Multicluster Global Hub 1.3.4	Unaffected: 1779212259 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.3::el9
Red Hat	Multicluster Global Hub 1.5.6	Unaffected: 1778867753 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.5::el9
Red Hat	Multicluster Global Hub 1.7.0	Unaffected: 1779925273 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Red Hat multicluster global hub 1.4.2	Unaffected: 1779579439 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Red Hat multicluster global hub 1.6.0	Unaffected: 1780167118 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.6::el9
Red Hat	Logging Subsystem for Red Hat OpenShift	cpe:/a:redhat:logging:6
Red Hat	Multicluster Global Hub	cpe:/a:redhat:multicluster_globalhub
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3

Date Public

2026-02-23 07:40

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T11:29:58.649315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T13:06:58.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Multicluster Global Hub 1.3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779212259",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Multicluster Global Hub 1.5.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778867753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Multicluster Global Hub 1.7.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779925273",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Red Hat multicluster global hub 1.4.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779579439",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Red Hat multicluster global hub 1.6.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780167118",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:logging:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-logging/lokistack-gateway-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel8",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-grafana-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/rhceph-5-dashboard-rhel8",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/rhceph-6-dashboard-rhel9",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhceph/grafana-rhel10",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/tempo-gateway-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosdt/tempo-query-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosdt/tempo-rhel9-operator",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-24T08:00:47.074Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-24T12:06:48.820Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-21728"
          },
          {
            "name": "RHBZ#2461395",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461395"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22423"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21769"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24503"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22347"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23345"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21769: Multicluster Global Hub 1.5.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24503: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22347: Red Hat multicluster global hub 1.4.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23345: Red Hat multicluster global hub 1.6.0"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T09:00:58.144Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-24T08:00:47.074Z",
            "value": "Made public."
          }
        ],
        "title": "grafana/tempo: Tempo: Denial of Service via large queries",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tempo",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "2.8.3",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.9.1",
              "status": "affected",
              "version": "2.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.10.1",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise Traces (GET)",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-02-23T07:40:45.862Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\n\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:22:50.209Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21728"
        }
      ],
      "source": {
        "discovery": "INTERNAL_FINDING"
      },
      "title": "Tempo query limit results in unbounded memory allocation",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21728",
    "datePublished": "2026-04-24T08:00:47.074Z",
    "dateReserved": "2026-01-05T09:26:06.215Z",
    "dateUpdated": "2026-08-27T17:22:50.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21728",
      "date": "2026-09-05",
      "epss": "0.00637",
      "percentile": "0.47948"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21728\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2026-04-24T09:16:03.710\",\"lastModified\":\"2026-08-24T13:17:31.983\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\\n\\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.\"}],\"affected\":[{\"source\":\"security@grafana.com\",\"affectedData\":[{\"vendor\":\"Grafana\",\"product\":\"Tempo\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.3.0\",\"lessThanOrEqual\":\"2.8.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.9.0\",\"lessThanOrEqual\":\"2.9.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.10.0\",\"lessThanOrEqual\":\"2.10.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Grafana\",\"product\":\"Enterprise Traces (GET)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.0.0\",\"lessThanOrEqual\":\"2.8.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"],\"versions\":[{\"version\":\"1779212259\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.5.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"],\"versions\":[{\"version\":\"1778867753\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.7.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.7::el9\"],\"versions\":[{\"version\":\"1779925273\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat multicluster global hub 1.4.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"],\"versions\":[{\"version\":\"1779579439\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat multicluster global hub 1.6.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"],\"versions\":[{\"version\":\"1780167118\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/lokistack-gateway-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/acm-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-5-dashboard-rhel8\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-6-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/grafana-rhel10\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/tempo-gateway-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/tempo-query-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/tempo-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/tempo-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-24T11:29:58.649315Z\",\"id\":\"CVE-2026-21728\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3.0\",\"versionEndExcluding\":\"2.8.4\",\"matchCriteriaId\":\"AE74525D-4401-4907-BB5F-E4FD2595CA5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.9.0\",\"versionEndExcluding\":\"2.9.2\",\"matchCriteriaId\":\"4F731ED3-2882-414C-B5FE-679B76A751A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:tempo:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.10.0\",\"versionEndExcluding\":\"2.10.2\",\"matchCriteriaId\":\"A90B7E68-DFF4-449F-A145-C1ABB0184B2E\"}]}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2026-21728\",\"source\":\"security@grafana.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21769\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22347\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22423\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24503\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-21728\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2461395\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-06T01:37:56+00:00",
      "cve": "CVE-2026-21728",
      "id": "CVE-2026-21728",
      "initial_release_date": "2026-04-24T08:00:47.074000+00:00",
      "product_status:fixed": "20",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "97",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana/tempo: Tempo: Denial of Service via large queries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-30T17:00:25Z",
      "cve": "CVE-2026-21728",
      "id": "CVE-2026-21728",
      "initial_release_date": "2026-07-30T17:00:25Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-21728",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-21728.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"grafana/tempo: Tempo: Denial of Service via large queries\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779212259\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.5.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1778867753\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.7.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779925273\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat multicluster global hub 1.4.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779579439\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat multicluster global hub 1.6.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780167118\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/lokistack-gateway-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub\", \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-grafana-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:5\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 5\", \"packageName\": \"rhceph/rhceph-5-dashboard-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 6\", \"packageName\": \"rhceph/rhceph-6-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"packageName\": \"rhceph/grafana-rhel10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/tempo-gateway-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/tempo-query-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/tempo-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/tempo-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-24T09:00:58.144Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-24T08:00:47.074Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:22423: Multicluster Global Hub 1.3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21769: Multicluster Global Hub 1.5.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24503: Multicluster Global Hub 1.7.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22347: Red Hat multicluster global hub 1.4.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23345: Red Hat multicluster global hub 1.6.0\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-24T08:00:47.074Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-21728\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2461395\", \"name\": \"RHBZ#2461395\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22423\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21769\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24503\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22347\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23345\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-24T12:06:48.820Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21728\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-24T11:29:58.649315Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-24T11:33:33.468Z\"}}], \"cna\": {\"title\": \"Tempo query limit results in unbounded memory allocation\", \"source\": {\"discovery\": \"INTERNAL_FINDING\"}, \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"Tempo\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.8.3\"}, {\"status\": \"affected\", \"version\": \"2.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.9.1\"}, {\"status\": \"affected\", \"version\": \"2.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.10.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Grafana\", \"product\": \"Enterprise Traces (GET)\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.8.7\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-02-23T07:40:45.862Z\", \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2026-21728\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\\n\\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.\"}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2026-08-26T08:50:46.532Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-21728\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T08:50:46.532Z\", \"dateReserved\": \"2026-01-05T09:26:06.215Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2026-04-24T08:00:47.074Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

cleanstart-2026-gx27419

Vulnerability from cleanstart

Published

2026-07-21 08:12

Modified

2026-07-09 14:29

Summary

Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-39822, CVE-2026-42151, CVE-2026-42505, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1, 12.3.8-r0

Details

Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-21728	WEB
	https://osv.dev/vulnerability/CVE-2026-2303	WEB
	https://osv.dev/vulnerability/CVE-2026-28377	WEB
	https://osv.dev/vulnerability/CVE-2026-39822	WEB
	https://osv.dev/vulnerability/CVE-2026-42151	WEB
	https://osv.dev/vulnerability/CVE-2026-42505	WEB
	https://osv.dev/vulnerability/CVE-2026-44903	WEB
	https://osv.dev/vulnerability/CVE-2026-48096	WEB
	https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w	WEB
	https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp	WEB
	https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf	WEB
	https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28	WEB
	https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc	WEB
	https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58	WEB
	https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-21728	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-2303	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-28377	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-39822	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42151	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42505	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44903	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48096	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.8-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-GX27419",
  "modified": "2026-07-09T14:29:31Z",
  "published": "2026-07-21T08:12:23.097576Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GX27419.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-39822"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42505"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48096"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48096"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-39822, CVE-2026-42151, CVE-2026-42505, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1, 12.3.8-r0",
  "upstream": [
    "CVE-2026-21728",
    "CVE-2026-2303",
    "CVE-2026-28377",
    "CVE-2026-39822",
    "CVE-2026-42151",
    "CVE-2026-42505",
    "CVE-2026-44903",
    "CVE-2026-48096",
    "ghsa-8396-jffm-qx4w",
    "ghsa-cp6g-7hqx-qxhp",
    "ghsa-ffqx-q65f-36jf",
    "ghsa-fw8g-cg8f-9j28",
    "ghsa-p4r4-xvrq-gvmc",
    "ghsa-w8rr-5gcm-pp58",
    "ghsa-wg65-39gg-5wfj"
  ]
}

cleanstart-2026-hx99883

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-09-04 12:17

Summary

Security fixes in grafana 13.1.0-r3

Details

Package grafana version 13.1.0-r3 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-46600, CVE-2026-56852...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.1.0-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "13.1.0-r3"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 13.1.0-r3 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-46600, CVE-2026-56852...",
  "id": "CLEANSTART-2026-HX99883",
  "modified": "2026-09-04T12:17:57Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 13.1.0-r3",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "ghsa-jpcw-4wr7-c3vq",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-46600",
    "CVE-2026-56852",
    "ghsa-hrxh-6v49-42gf",
    "ghsa-ffqx-q65f-36jf",
    "ghsa-p4r4-xvrq-gvmc",
    "CVE-2026-21728",
    "CVE-2026-28377"
  ]
}

cleanstart-2026-ie49312

Vulnerability from cleanstart

Published

2026-07-21 09:20

Modified

2026-06-30 13:20

Summary

Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1

Details

Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-21728	WEB
	https://osv.dev/vulnerability/CVE-2026-2303	WEB
	https://osv.dev/vulnerability/CVE-2026-28377	WEB
	https://osv.dev/vulnerability/CVE-2026-42151	WEB
	https://osv.dev/vulnerability/CVE-2026-44903	WEB
	https://osv.dev/vulnerability/CVE-2026-48096	WEB
	https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w	WEB
	https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp	WEB
	https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf	WEB
	https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28	WEB
	https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc	WEB
	https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58	WEB
	https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-21728	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-2303	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-28377	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42151	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44903	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48096	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.2.10-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-IE49312",
  "modified": "2026-06-30T13:20:18Z",
  "published": "2026-07-21T09:20:19.188014Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IE49312.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48096"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48096"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1",
  "upstream": [
    "CVE-2026-21728",
    "CVE-2026-2303",
    "CVE-2026-28377",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "CVE-2026-48096",
    "ghsa-8396-jffm-qx4w",
    "ghsa-cp6g-7hqx-qxhp",
    "ghsa-ffqx-q65f-36jf",
    "ghsa-fw8g-cg8f-9j28",
    "ghsa-p4r4-xvrq-gvmc",
    "ghsa-w8rr-5gcm-pp58",
    "ghsa-wg65-39gg-5wfj"
  ]
}

cleanstart-2026-kq21500

Vulnerability from cleanstart

Published

2026-09-01 11:17

Modified

2026-09-04 11:14

Summary

Security fixes in grafana 12.3.10-r1

Details

Package grafana version 12.3.10-r1 fixes 15 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.10-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.3.10-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 12.3.10-r1 fixes 15 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...",
  "id": "CLEANSTART-2026-KQ21500",
  "modified": "2026-09-04T11:14:10Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 12.3.10-r1",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "ghsa-jpcw-4wr7-c3vq",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "CVE-2026-48096",
    "CVE-2026-55689",
    "CVE-2026-55170",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "CVE-2026-40179",
    "CVE-2026-2303",
    "CVE-2026-39882",
    "ghsa-259r-337f-4rfw",
    "CVE-2026-41178"
  ]
}

cleanstart-2026-lc55153

Vulnerability from cleanstart

Published

2026-07-21 08:24

Modified

2026-07-03 09:44

Summary

Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, CVE-2026-55170, CVE-2026-55689, ghsa-8396-jffm-qx4w, ghsa-cf98-j28v-49v6, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-hcxc-wf8j-23hv, ghsa-mpwr-8vm7-h73f, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1, 13.1.0-r1

Details

Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-21728	WEB
	https://osv.dev/vulnerability/CVE-2026-2303	WEB
	https://osv.dev/vulnerability/CVE-2026-28377	WEB
	https://osv.dev/vulnerability/CVE-2026-42151	WEB
	https://osv.dev/vulnerability/CVE-2026-44903	WEB
	https://osv.dev/vulnerability/CVE-2026-48096	WEB
	https://osv.dev/vulnerability/CVE-2026-55170	WEB
	https://osv.dev/vulnerability/CVE-2026-55689	WEB
	https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w	WEB
	https://osv.dev/vulnerability/ghsa-cf98-j28v-49v6	WEB
	https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp	WEB
	https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf	WEB
	https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28	WEB
	https://osv.dev/vulnerability/ghsa-hcxc-wf8j-23hv	WEB
	https://osv.dev/vulnerability/ghsa-mpwr-8vm7-h73f	WEB
	https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc	WEB
	https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58	WEB
	https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-21728	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-2303	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-28377	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42151	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44903	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48096	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-55170	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-55689	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.1.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-LC55153",
  "modified": "2026-07-03T09:44:40Z",
  "published": "2026-07-21T08:24:07.888703Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC55153.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48096"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-55170"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-55689"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cf98-j28v-49v6"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cp6g-7hqx-qxhp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-hcxc-wf8j-23hv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mpwr-8vm7-h73f"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2303"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28377"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48096"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55170"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55689"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, CVE-2026-55170, CVE-2026-55689, ghsa-8396-jffm-qx4w, ghsa-cf98-j28v-49v6, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-hcxc-wf8j-23hv, ghsa-mpwr-8vm7-h73f, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1, 13.1.0-r1",
  "upstream": [
    "CVE-2026-21728",
    "CVE-2026-2303",
    "CVE-2026-28377",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "CVE-2026-48096",
    "CVE-2026-55170",
    "CVE-2026-55689",
    "ghsa-8396-jffm-qx4w",
    "ghsa-cf98-j28v-49v6",
    "ghsa-cp6g-7hqx-qxhp",
    "ghsa-ffqx-q65f-36jf",
    "ghsa-fw8g-cg8f-9j28",
    "ghsa-hcxc-wf8j-23hv",
    "ghsa-mpwr-8vm7-h73f",
    "ghsa-p4r4-xvrq-gvmc",
    "ghsa-w8rr-5gcm-pp58",
    "ghsa-wg65-39gg-5wfj"
  ]
}

cleanstart-2026-rh24736

Vulnerability from cleanstart

Published

2026-09-01 11:17

Modified

2026-09-04 11:14

Summary

Security fixes in grafana 12.4.9-r1

Details

Package grafana version 12.4.9-r1 fixes 9 vulnerabilities: ghsa-r277-6w6q-xmqw, CVE-2026-73502, CVE-2026-42151, CVE-2026-44903, CVE-2026-21728...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.4.9-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.4.9-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 12.4.9-r1 fixes 9 vulnerabilities: ghsa-r277-6w6q-xmqw, CVE-2026-73502, CVE-2026-42151, CVE-2026-44903, CVE-2026-21728...",
  "id": "CLEANSTART-2026-RH24736",
  "modified": "2026-09-04T11:14:10Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 12.4.9-r1",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "CVE-2026-73502",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-2303",
    "ghsa-259r-337f-4rfw"
  ]
}

cleanstart-2026-ru71621

Vulnerability from cleanstart

Published

2026-09-01 11:17

Modified

2026-09-04 11:14

Summary

Security fixes in grafana 12.4.7-r1

Details

Package grafana version 12.4.7-r1 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.4.7-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.4.7-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 12.4.7-r1 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...",
  "id": "CLEANSTART-2026-RU71621",
  "modified": "2026-09-04T11:14:10Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 12.4.7-r1",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "ghsa-jpcw-4wr7-c3vq",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "CVE-2026-42151",
    "CVE-2026-40179",
    "CVE-2026-44903",
    "CVE-2026-2303",
    "ghsa-259r-337f-4rfw"
  ]
}

cleanstart-2026-vi74714

Vulnerability from cleanstart

Published

2026-09-01 11:17

Modified

2026-09-04 11:14

Summary

Security fixes in grafana 13.0.5-r1

Details

Package grafana version 13.0.5-r1 fixes 8 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, CVE-2026-21728, CVE-2026-28377, CVE-2026-42151...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.0.5-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "13.0.5-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 13.0.5-r1 fixes 8 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, CVE-2026-21728, CVE-2026-28377, CVE-2026-42151...",
  "id": "CLEANSTART-2026-VI74714",
  "modified": "2026-09-04T11:14:10Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 13.0.5-r1",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "ghsa-jpcw-4wr7-c3vq",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "CVE-2026-42151",
    "CVE-2026-40179",
    "CVE-2026-44903",
    "ghsa-259r-337f-4rfw"
  ]
}

cleanstart-2026-vu77552

Vulnerability from cleanstart

Published

2026-09-01 11:17

Modified

2026-09-04 11:14

Summary

Security fixes in grafana 13.0.7-r1

Details

Package grafana version 13.0.7-r1 fixes 8 vulnerabilities: ghsa-r277-6w6q-xmqw, CVE-2026-73502, CVE-2026-42151, CVE-2026-44903, CVE-2026-40179...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.0.7-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "13.0.7-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 13.0.7-r1 fixes 8 vulnerabilities: ghsa-r277-6w6q-xmqw, CVE-2026-73502, CVE-2026-42151, CVE-2026-44903, CVE-2026-40179...",
  "id": "CLEANSTART-2026-VU77552",
  "modified": "2026-09-04T11:14:10Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 13.0.7-r1",
  "upstream": [
    "ghsa-r277-6w6q-xmqw",
    "CVE-2026-73502",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "CVE-2026-40179",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "ghsa-259r-337f-4rfw"
  ]
}

cleanstart-2026-yp95633

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-09-04 12:17

Summary

Security fixes in grafana 12.2.10-r1

Details

Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...

References

URL

Type

https://grafana.com

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.2.10-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.2.10-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...",
  "id": "CLEANSTART-2026-YP95633",
  "modified": "2026-09-04T12:17:57Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in grafana 12.2.10-r1",
  "upstream": [
    "ghsa-p4r4-xvrq-gvmc",
    "ghsa-ffqx-q65f-36jf",
    "CVE-2026-21728",
    "CVE-2026-28377",
    "ghsa-wg65-39gg-5wfj",
    "ghsa-fw8g-cg8f-9j28",
    "CVE-2026-42151",
    "CVE-2026-44903",
    "ghsa-cp6g-7hqx-qxhp",
    "CVE-2026-2303",
    "ghsa-8396-jffm-qx4w",
    "CVE-2026-48096",
    "ghsa-w8rr-5gcm-pp58"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-21728 (GCVE-0-2026-21728)

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Vulnerability from cleanstart

Tags

Sightings

Nomenclature