2.0 KiB
2.0 KiB
grafana — triage (group C, 2026-10-27)
Pin: grafana/grafana:13.2.3. No gate field; Grafana login; admin password required from env; public sign-up off (upstream default allow_sign_up=false).
Notices (4 + 1 release hit)
All four GitHub advisories are 2022-era with unreadable/open ranges; every one was fixed years ago:
- GHSA-2x6g-h2hg-rq84 CVE-2022-39306: NOT-A-FINDING — fixed 9.2.4 / 8.5.15 (its own text).
- GHSA-4724-7jwc-3fpw CVE-2022-39324: NOT-A-FINDING — fixed in 9.2.8 / 9.3.2 / 8.5.16 (Grafana 2023-01 release; from memory, not re-read).
- GHSA-8wjh-59cw-9xh4 CVE-2022-21673: NOT-A-FINDING — fixed 7.5.13 / 8.3.4 (2022-01; from memory). Range "> 7.2.0" has no upper end.
- GHSA-8xmm-x63g-f6xv CVE-2022-23552: NOT-A-FINDING — fixed 9.2.10 / 9.3.4 / 8.5.16 (2023-01; from memory). Range ">=8.1" has no upper end.
- release:v13.2.4 — REAL security release of Grafana: CVE-2026-15577 (Git Sync connection config modifiable with read-only access, 6.5), CVE-2026-33374 (unbounded memory in Prometheus rule conversion API, 6.5), CVE-2026-93294 (Azure Monitor resource proxy reaches arbitrary ARM APIs, 6.3), CVE-2026-95502 (Git Sync memory exhaustion via malicious Git server, 5.3); CVE-2026-92539 is Enterprise SCIM (we run OSS). Source: grafana.com/security/security-advisories listing, 2026-10-13. Affected ranges not on the listing. Login: all need a Grafana account (15577 read-only; others need editor/datasource rights — unsure exact role). Reachable: only accounts the household created. Git Sync and Azure Monitor are not configured by our template. Worst real: medium.
Fix
Smallest/TARGET: 13.2.4 (Docker Hub tag 13.2.4, no v; newest 13.2.x). Same main: yes. Breaking (read v13.2.4): none found — provisioning/Git Sync fixes, Alerting oauth2 header stripping. Lane: SECURITY_FIX (release hit); the 4 GHSAs NOT_A_FINDING.
Classifier note
Drop advisories whose range is malformed/open-ended AND whose published date is >2 years older than the pinned release (all four here are 2022/2023, fixed in 8.x/9.x).