RHSA-2026:83544HighCVSS 8.8

Red Hat Security Advisory: grafana security update

Published
October 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-15815 →

📋 Description

CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-0:9.2.10-35.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-0:9.2.10-35.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-0:9.2.10-35.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-0:9.2.10-35.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-0:9.2.10-35.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debuginfo-0:9.2.10-35.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debuginfo-0:9.2.10-35.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debuginfo-0:9.2.10-35.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debuginfo-0:9.2.10-35.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debugsource-0:9.2.10-35.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debugsource-0:9.2.10-35.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debugsource-0:9.2.10-35.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-debugsource-0:9.2.10-35.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-selinux-0:9.2.10-35.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-selinux-0:9.2.10-35.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-selinux-0:9.2.10-35.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • grafana-selinux-0:9.2.10-35.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability.

🔗 References (4)