RHSA-2026:99151HighCVSS 7.7

Red Hat Security Advisory: grafana security update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (2)

CVE-2026-88967 →CVE-2026-116591 →

📋 Description

CVE-2026-88967 — grafana: Azure Monitor data source could leak its Azure access token CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-0:10.2.6-23.el9_8.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-0:10.2.6-23.el9_8.10.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-0:10.2.6-23.el9_8.10.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-0:10.2.6-23.el9_8.10.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-0:10.2.6-23.el9_8.10.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debuginfo-0:10.2.6-23.el9_8.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debuginfo-0:10.2.6-23.el9_8.10.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debuginfo-0:10.2.6-23.el9_8.10.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debuginfo-0:10.2.6-23.el9_8.10.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debugsource-0:10.2.6-23.el9_8.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debugsource-0:10.2.6-23.el9_8.10.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debugsource-0:10.2.6-23.el9_8.10.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-debugsource-0:10.2.6-23.el9_8.10.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-selinux-0:10.2.6-23.el9_8.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-selinux-0:10.2.6-23.el9_8.10.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-selinux-0:10.2.6-23.el9_8.10.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
  • grafana-selinux-0:10.2.6-23.el9_8.10.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict query permissions on configured Azure Monitor data sources exclusively to trusted users, or remove the data source configuration entirely if it is not in active use. 1. Within the Grafana administration interface, open the Azure Monitor data source settings and adjust permissions to limit query access only to trusted administrative roles. 2. If Azure Monitor is no longer needed, remove the data source configuration from Grafana. 3. At the cloud provider level, reduce permissions assigned to the Azure identity or service principal used by Grafana to enforce the principle of least privilege. Caveats: Restricting query access or deleting the data source will prevent non-administrative users from viewing dashboards, panels, or alerts that rely on Azure Monitor metrics. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (5)