Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1021
_____________________________________________________________________

DATE                : 14/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Grafana versions prior to 12.4.13,
                                  13.0.11, 13.1.8, 13.2.4.

====================================================================
https://grafana.com/security/security-advisories/cve-2026-15577/
https://grafana.com/security/security-advisories/cve-2026-33374
https://grafana.com/security/security-advisories/cve-2026-93294/
https://grafana.com/security/security-advisories/cve-2026-95502
_____________________________________________________________________

Git Sync connection configuration can be modified with read-only
access

Medium

Advisory ID:  CVE-2026-15577
Published:    2026-10-13
Product:      Grafana
CVSS Score:   6.5
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Fixed Versions:  <12.4.0
                 >=12.4.13 <13.0.0
                 >=13.0.11 <13.1.0
                 >=13.1.8 <13.2.0
                 >=13.2.4


Summary

A user or service account with read-only access to Git Sync
(provisioning) connections can modify a connection's configuration
through its status subresource (incorrect authorization). On Grafana
12.4 the affected API is only available when the experimental
provisioning feature toggle is enabled.

_____________________________________________________________________

Unbounded memory allocation in the Prometheus rule conversion API

Medium

Advisory ID:     CVE-2026-33374
Published:       2026-10-13
Product:         Grafana
CVSS Score:      6.5
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed Versions:  <12.0.0
                 >=12.4.13 <13.0.0
                 >=13.0.11 <13.1.0
                 >=13.1.8 <13.2.0
                 >=13.2.4


Summary

The Prometheus rule conversion API endpoints in Grafana do not limit
request body size, allowing authenticated users to trigger unbounded
memory allocations that can crash the server through out-of-memory
conditions.

_____________________________________________________________________

Azure Monitor data source resource proxy allows calls to arbitrary
Azure Resource Manager APIs

Medium

Advisory ID:     CVE-2026-93294
Published:       2026-10-13
Product:         Grafana
CVSS Score:      6.3
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Fixed Versions:
                 <8.1.0
                 >=12.4.13 <13.0.0
                 >=13.0.11 <13.1.0
                 >=13.1.8 <13.2.0
                 >=13.2.4


Summary

A user with query access to an Azure Monitor data source can use its
resource proxy to call Azure Resource Manager APIs beyond those
Grafana needs, with the data source's Azure identity (unintended
proxy). The impact is bounded by the Azure role granted to that
identity.

_____________________________________________________________________

Git Sync memory exhaustion via a malicious Git server

Medium

Advisory ID:     CVE-2026-95502
Published:       2026-10-13
Product:         Grafana
CVSS Score:      5.3
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Fixed Versions:
                  <13.0.0
                  >=13.0.11 <13.1.0
                  >=13.1.8 <13.2.0
                  >=13.2.4


Summary

A Git server that Grafana's Git Sync (provisioning) is configured to
use can exhaust Grafana's memory by returning oversized or highly
compressed responses (uncontrolled resource consumption). Exploitation
requires an administrator to have configured Git Sync with that server.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================