https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for grafana/grafana en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/676 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/676 Thu, 27 Aug 2026 01:09:51 GMT The LibraryPanel update handler passed the existing object to UpdatedObject without deep copying, allowing an in-place PATCH transformer to mutate its folder UID before authorization. A user with read-only access to a library panel's source folder but create access to a different folder could move the panel by changing the folder in the patch, bypassing source folder update permission. The patch uses DeepCopyObject to keep the original object immutable so source-folder authorization cannot be bypassed. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/603 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/603 Tue, 25 Aug 2026 20:00:55 GMT Before this patch, VectorSearch skipped server-side per-result access checks for external vector collections (coll.IsExternal). Any authenticated user with access to the vector search endpoint could retrieve all rows from an external collection, bypassing folder-scoped RBAC for resources such as alert rules. The patch adds BatchCheck enforcement for external collections and introduces a folder field to EmbeddingInput to validate per-row authorization. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/595 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/595 Tue, 25 Aug 2026 13:11:59 GMT In multi-tenant deployments, the SSOSettingsStore used a fixed database connection and ignored tenant context, causing OAuth login for one tenant to read SSO settings from the shared table. This allowed SSO configuration from one tenant to be applied to another, potentially enabling cross-tenant authentication bypass. The patch resolves the legacy database provider from the request context and uses the tenant-specific table name. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/574 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/574 Mon, 24 Aug 2026 14:12:19 GMT The previous code logged OAuth access tokens and refresh tokens in debug-level logs during token refresh. This exposed bearer credentials to anyone with read access to Grafana logs, potentially enabling account takeover. The patch replaces raw token values with boolean presence indicators. Patch landed 1 hour 51 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/569 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/569 Mon, 24 Aug 2026 08:23:14 GMT With gzip compression enabled, each HEAD request carrying Accept-Encoding: gzip caused a permanent goroutine leak because web.ResponseWriter reported a short write (0, nil), and pgzip's Close returned without releasing the compressor goroutine. Repeated requests exhaust memory and goroutines, allowing remote denial of service. The patch skips compression for HEAD responses and reports dropped HEAD bodies as fully written. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/539 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/539 Fri, 21 Aug 2026 19:10:03 GMT Before the patch, the scope resolver unconditionally expanded permissions:type:delegate to a wildcard scope for all RBAC actions. This meant that a user granted only delegation rights for a specific action (e.g., dashboards:read) could also perform that action on every resource, effectively obtaining global access to the action's target resource. The fix restricts wildcard expansion to role-management actions, ensuring delegate grants only delegate and do not grant the underlying action itself. Patch landed 2 days 20 hours 23 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/508 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/508 Thu, 20 Aug 2026 13:33:25 GMT Before the patch, the service account tokens API did not enforce admin-configured maximum token expiration settings (`auth.api_key_max_seconds_to_live` and `service_accounts.token_expiration_day_limit`). A user with permission to create service account tokens could create tokens with no expiration or longer lifetimes than allowed, bypassing organizational security policy. The patch adds validation in `handleCreate` to reject such requests. medium confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/492 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/492 Wed, 19 Aug 2026 15:54:36 GMT The authorization evaluator for alert rules skipped datasource query permission checks for any query with QueryType equal to expr.DatasourceType, regardless of the actual DatasourceUID. An attacker who can create or modify alert rules but lacks query permission on a target datasource could set QueryType to 'expression' while setting DatasourceUID to a real datasource UID, bypassing authorization and querying the datasource at evaluation time. The patch removes the QueryType check and only skips queries whose DatasourceUID is the built-in expression datasource UID. Patch landed 2 hours 44 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/466 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/466 Tue, 18 Aug 2026 18:36:33 GMT The OAuth strategy config loading accessed a shared ini.File concurrently without synchronization. Under concurrent OAuth login requests or settings refreshes, the ini library's internal map is read and written simultaneously, causing a fatal 'concurrent map read and map write' panic that crashes Grafana. The patch replaces direct ini.File access with GetSections() that returns a private copy, eliminating the race. Patch landed 5 days 21 hours 4 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/460 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/460 Tue, 18 Aug 2026 16:23:18 GMT In unified storage Mode5, the bulk team permission endpoint did not redirect team membership writes to Team.Spec.Members; it only updated K8s ResourcePermission objects and skipped the actual membership store. Removing a user from a team via this endpoint left the user as a team member, preserving their team-based access to dashboards, folders, and other resources. The patch routes bulk team permission changes through the same membership redirect used for single-user updates, ensuring removals are reflected in Team.Spec.Members. Patch landed 13 days 5 hours 25 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/461 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/461 Tue, 18 Aug 2026 16:24:40 GMT Before the patch, the redactSecrets function only redacted secret fields at the top level of SSOSetting settings, leaving nested LDAP secrets such as bind_password under config.servers\[\] exposed in API responses. An attacker with read access to the SSOSetting API could retrieve plaintext LDAP bind passwords. The patch adds recursive redaction for nested LDAP server maps, preventing this leak. Patch landed 13 days 5 hours 35 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/423 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/423 Fri, 14 Aug 2026 16:12:07 GMT The MT-Settings backed SSOSetting store returned plaintext secret values (client_secret, private_key, certificate, password, client_key) in API responses for Get/Create/Update operations, since the settings service decrypts secrets on read and the store echoed them unredacted. This deviates from the legacy /api/v1/sso-settings contract which redacts secrets, exposing sensitive OAuth/SAML credentials to any caller with read access to the SSOSetting API. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/417 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/417 Thu, 13 Aug 2026 10:44:49 GMT The trash search endpoint returned Bleve's unfiltered match count as TotalHits whenever the requested page filled before the authorization scan was exhausted. Because that count included deletions belonging to other users (not just the caller's own), a low-privileged user with just one deletion of their own could vary title/field filters and infer, via the returned total, how many other users' deletions matched a given filter — leaking information about resources they are not authorized to see, even though marking the total 'inexact' did not prevent this reliable signal. Patch landed 18 days 11 hours 46 minutes before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/414 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/414 Wed, 12 Aug 2026 15:36:29 GMT The trash search path used the ordinary read-access check for authorizing per-item visibility of deleted objects, instead of the stricter trash rule (folder-admin or the user who deleted the item) applied by the list path. Since read access to a folder is commonly granted to many users, any user with read access to a folder could see deleted (trashed) objects belonging to other users within that folder via the search API, even though they were not the deleter or a folder admin. Patch landed 19 days 6 hours 25 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/381 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/381 Fri, 07 Aug 2026 00:33:37 GMT The dashboard snapshot apiserver resolved snapshots by a global key without verifying that the snapshot belonged to the caller's organization/namespace. An authenticated user with snapshot delete permission in their own org could supply another org's public snapshot key to the `deletekey` subresource or `DELETE` endpoint, allowing them to read the secret deleteKey or delete a snapshot belonging to a different organization without proper authorization. Patch landed 24 days 22 hours 16 minutes before CVE-2026-19197 was published. high confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/372 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/372 Wed, 05 Aug 2026 11:45:49 GMT The ShortURL API authorizer allowed any authenticated user (including org role None) to update or patch the status subresource of any short URL object, regardless of ownership. This let non-privileged users, or even users with the lowest permission level, tamper with the status (e.g., lastSeenAt) field of short URLs belonging to other users/organizations, which the fix now restricts to admin-only access. Patch landed 14 days 7 hours 7 minutes before CVE-2026-17183 was published. medium confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/368 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/368 Tue, 04 Aug 2026 20:05:44 GMT The previous authorizer for the ShortURL Kubernetes API allowed any authenticated user, regardless of org role, to perform any operation including list, watch, delete, deletecollection, and update on any short URL resource. This means a low-privileged user (e.g., org role None or Viewer) could list all short URLs in the org (exposing internal paths/links created by other users) or delete/modify short URLs belonging to other users, since there was no ownership or role check. Patch landed 27 days 2 hours before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/354 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/354 Fri, 24 Jul 2026 22:19:57 GMT The Graphite datasource read upstream /render responses and inbound resource-call request bodies fully into memory via io.ReadAll without any size limit. A malicious or compromised Graphite backend could return an extremely large (or decompression-bomb) response, or an authenticated user could send an oversized request body to a resource endpoint, forcing Grafana to allocate unbounded memory and crash the process (OOM). The patch adds configurable byte caps enforced via io.LimitReader and http.MaxBytesReader, rejecting oversized bodies with clear errors/HTTP 413. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/351 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/351 Fri, 24 Jul 2026 10:30:19 GMT Before this patch, the notification-history app installer did not wire in an AccessClient or enable RBAC filtering, so notification history queries were not restricted to folders the requesting user is authorized to read via `alert.rules:read`. This allowed any authenticated user (in a multi-tenant deployment) to query and view notification history for alert rules/folders belonging to other tenants or users without the required permissions, leaking potentially sensitive alerting/notification data across tenant boundaries. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/348 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/348 Thu, 23 Jul 2026 12:13:09 GMT The localRepository's Create, Update, Write, Delete, and Move functions joined user-controlled paths (e.g. derived from folder/dashboard titles during export) directly with the repository root using safepath.Join without verifying the result stayed within the root directory. An attacker-controlled title containing traversal sequences like '../../../etc' could cause file writes, deletes, or moves outside the intended repository folder on the local filesystem. Patch landed 32 days 3 hours 32 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/347 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/347 Wed, 22 Jul 2026 21:06:16 GMT When force-deleting a folder via kubernetesFolderCascadeDelete, the cascade delete operation ran under a service identity that bypasses per-resource permission checks. A user who only had folders:delete permission (but not alert.rules:delete or folders:write on contained resources) could trigger deletion of alert rules and library elements within the folder subtree that they had no rights to access or modify, since only the top-level folder delete permission was checked before the entire cascade ran with elevated service-identity privileges. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/341 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/341 Tue, 21 Jul 2026 13:53:53 GMT In the RBAC authz Check/BatchCheck flow, requests with an empty resource name but a specified parent folder were incorrectly answered by a capabilities-style early return that allows access if the user holds the action on ANY scope, ignoring the folder entirely. This let a user with permission on an unrelated folder (or resource instance) be granted access to folder-scoped queries such as 'can I list/set-permissions within folder X', effectively bypassing folder-based access restrictions. Patch landed 29 days 5 hours 3 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/339 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/339 Mon, 20 Jul 2026 16:03:30 GMT When the LimitEmailToOrgMembers setting is enabled, Grafana restricts email notification integrations to only send to addresses belonging to organization members, preventing data exfiltration of alert data to arbitrary external emails. The email validator only checked V1 email integration configs and silently skipped V0 (Mimir) email integrations, allowing a user able to configure contact points to bypass the org-membership restriction entirely by using the V0mimir1 email integration type with arbitrary 'to' addresses. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/322 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/322 Tue, 14 Jul 2026 16:41:51 GMT The v14→v16 dashboard schema migration's getPanelPosition function recursed unconditionally when a panel could not fit into the row's grid area. A legacy row panel with a span greater than 12 produces a panelWidth larger than the 24-column grid, meaning it can never satisfy the fit check, causing infinite recursion and a stack overflow that crashes the Grafana backend process. The patch restores a callOnce guard so the function wraps to the next row at most once before returning nil instead of recursing forever. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/304 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/304 Fri, 03 Jul 2026 10:12:17 GMT Before this patch, the RBAC allowlist for unified storage did not include 'serviceaccounts' under the 'iam.grafana.app' group. This meant that when listing/searching/reading service accounts, the authzLimitedClient would not apply RBAC filtering, potentially allowing users without proper permissions to enumerate or read service account resources. The fix adds 'serviceaccounts' to the allowlist so that RBAC checks are properly enforced during list/search operations. Patch landed 7 days 9 hours 18 minutes before CVE-2026-33382 was published. high confirmed CVE-2026-33382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/300 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/300 Tue, 30 Jun 2026 20:15:47 GMT The GET /api/library-elements/name/:name endpoint was registered without any authentication or authorization middleware, allowing unauthenticated or unprivileged users to read library panel data by name. The patch adds the standard `authorize(ac.EvalPermission(ActionLibraryPanelsRead))` middleware to enforce the library.panels:read permission check before serving the response. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/294 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/294 Tue, 23 Jun 2026 17:23:19 GMT The Kubernetes-based GET /tags API endpoint in Grafana's annotation app returned all annotation tags to any authenticated user regardless of their permissions. Before the patch, the tags handler was initialized without an access client and performed no authorization checks, meaning any authenticated user (including those with org role = None and no permissions) could enumerate all annotation tags in an organization. The patch adds a call to `authorizeReadOrganizationAnnotations` that verifies the caller has `annotations:read` permission with organization scope before returning tag data. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/292 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/292 Tue, 23 Jun 2026 10:26:45 GMT Before the patch, the `listPermission` function for mapper-miss resources (folder-scoped CRDs like `*.ext.grafana.app`) would hit the `scopeMap\["*"\]` early-return check before forking to the folder-authz model. This meant that if a user had a resource-type wildcard permission (e.g., `unregistered.grafana.app/widgets:get` with scope `*`), the LIST endpoint would return `All: true` (allowing all objects) without requiring any folder-level authorization. The fix forks to `listPermissionWithFolderAuthz` before the wildcard check, ensuring folder-scoped resources always require both a stack role AND folder-level permission. Patch landed 57 days 8 hours 48 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/263 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/263 Tue, 16 Jun 2026 08:18:35 GMT The Loki data source plugin allowed path traversal attacks via the resource URL parameter. Before the patch, user-supplied URL segments were directly interpolated into the Loki API path without validation, allowing an attacker to use '../' sequences to escape the '/loki/api/v1/' prefix and access arbitrary backend endpoints. The fix adds URL parsing and path cleaning to reject any paths that don't remain within the '/loki/api/v1/' prefix. Patch landed 6 days 7 hours 36 minutes before CVE-2026-10601 was published. high confirmed CVE-2026-10601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/255 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/255 Wed, 10 Jun 2026 08:11:04 GMT When Zanzana resolved permissions and mapped them back to legacy RBAC format, the scope was derived from the action prefix rather than the resource type. For sub-resource actions like `folders.permissions:read`, this produced `folders.permissions:uid:<uid>` instead of `folders:uid:<uid>`. Since legacy RBAC's `canAdmin` check evaluates `EvalPermission(folders.permissions:read, folders:uid:<uid>)`, the scope never matched and a user with admin rights on a folder could not manage that folder's permissions even though they were authorized to do so. The fix scopes objects by the resource type Zanzana listed them under, ensuring correct permission matching. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/252 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/252 Mon, 08 Jun 2026 20:31:05 GMT Before the patch, the contact point settings redaction logic used case-sensitive key matching when identifying secret fields to redact. An attacker or user with write access could submit secret field keys with non-canonical casing (e.g., 'INTEGRATIONKEY' instead of 'integrationKey') to bypass redaction, causing the plaintext secret to be returned in API responses instead of being redacted. The patch makes the field extraction and redaction logic case-insensitive so secrets are properly identified and redacted regardless of key casing. Patch landed 76 days 19 hours 37 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/249 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/249 Mon, 08 Jun 2026 10:30:08 GMT The LinkButton component in @grafana/ui rendered an <a> element with the href prop passed directly without sanitization. An attacker could inject a javascript: URL as the href value, which would execute arbitrary JavaScript when a user clicked the link. The patch extracts href from the spread props, sanitizes it via textUtil.sanitizeUrl (which neutralizes dangerous schemes like javascript:, data:, and vbscript: to about:blank), and places the sanitized value after {...otherProps} so it always wins. Patch landed 77 days 5 hours 41 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/232 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/232 Tue, 02 Jun 2026 20:16:11 GMT In the IAM K8s role API, a user holding `permissions:type:delegate` had their scope resolved to the wildcard `*` in the RBAC scope map. The `checkPermission` function short-circuited on wildcard presence, allowing a delegate holder to satisfy ANY scope check including `permissions:type:escalate`. This meant a user with only delegate permissions could perform escalate-level operations (granting elevated roles they shouldn't be able to grant). The fix adds `SkipWildcard: true` to the permissions resource mapping and retains the literal `permissions:type:*` scope alongside the resolved wildcard, so exact scope matching is required for permission type checks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/224 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/224 Fri, 29 May 2026 18:03:27 GMT When a user configured a git repository with an `http://` URL and a personal access token (PAT), the token was transmitted in cleartext on every git operation because `git.NewRepository` adds basic auth unconditionally regardless of the URL scheme. The validators never rejected this combination, meaning tokens could be intercepted by network observers. The patch adds validation that rejects `http://` URLs when a token is configured (unless explicitly allowed via `allow_insecure` flag or development mode). medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/221 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/221 Fri, 29 May 2026 14:23:37 GMT The Alert Group edit route was registered with only read-level permissions (AlertingRuleRead/AlertingRuleExternalRead), meaning Viewer-role users could navigate directly to the edit URL and interact with the editable group form. While the backend correctly returned 403 on save attempts, the frontend exposed the full edit UI to unauthorized users. The patch changes the route guard to require AlertingRuleUpdate/AlertingRuleExternalWrite, aligning it with other edit routes. Patch landed 24 days 1 hour 10 minutes before CVE-2026-10601 was published. low confirmed CVE-2026-10601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/222 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/222 Fri, 29 May 2026 14:24:07 GMT GitHub provisioning webhooks were authenticated by HMAC signature only, but the HMAC covers only the request body (not headers or timestamps). This means a captured (body, X-Hub-Signature-256) tuple could be replayed indefinitely until the webhook secret rotates, causing repeated re-enqueueing of sync jobs. The patch adds a TTL-bounded replay cache keyed on the validated signature, silently dropping previously-seen signed requests. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/220 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/220 Fri, 29 May 2026 10:46:54 GMT The `SnapshotPublicModeOrCreate` and `SnapshotPublicModeOrDelete` middleware functions called `ac.Middleware(ac2)(ac.EvalPermission(...))` which returned a new HTTP handler but never invoked it, effectively making the RBAC permission check dead code. Any authenticated user could create or delete snapshots regardless of whether they had the required permissions (`snapshots:create` or `snapshots:delete`). The patch fixes this by directly calling `ac2.Evaluate()` and properly enforcing the permission check. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/219 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/219 Thu, 28 May 2026 22:06:38 GMT The `GetDataSourcesByType` method in Grafana's datasource service returned all datasources of a given type without checking the caller's `datasources:read` permissions. An authenticated user with access to the API endpoint that internally calls `GetDataSourcesByType` (e.g., `ListConnections` with a plugin filter) could enumerate and read metadata for datasources they are not authorized to access. The patch adds per-datasource permission evaluation using the requester's access control scopes before returning results. Patch landed 24 days 20 hours 56 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/217 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/217 Thu, 28 May 2026 16:25:38 GMT Before the patch, the DELETE endpoint for short URLs in the Kubernetes storage backend deleted by UID alone without scoping to the caller's org ID. This meant a user in one organization could delete short URLs belonging to another organization by simply knowing or guessing the UID. The patch adds org_id scoping to the DELETE SQL query, ensuring users can only delete short URLs within their own organization. Patch landed 40 days 9 hours 17 minutes before CVE-2026-28378 was published. high confirmed CVE-2026-28378 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/218 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/218 Thu, 28 May 2026 16:26:00 GMT Before this patch, the `validateOnUpdate` function in the Grafana folder API did not perform any access escalation check when a folder was moved to a new parent. This allowed an authenticated user (e.g., an Editor in a target folder) to move a folder they had write access to into a destination folder where they had higher privileges than at the source, effectively gaining elevated permissions over the folder's contents transitively. The patch adds a `checkMoveAccess` call that uses a BatchCheck to compare the user's permission tier at the old parent vs. the new parent and blocks moves that would result in privilege escalation. Patch landed 88 days 34 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/213 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/213 Thu, 28 May 2026 11:01:37 GMT The `ref` query parameter in the `history` and `files` endpoints was forwarded directly to backends (including the GitHub REST API) without any validation. An attacker could supply a malicious `ref` value containing shell metacharacters, path traversal sequences, or other dangerous strings that would be passed as-is to api.github.com or local git operations. The patch adds validation at the connector layer, rejecting any `ref` that isn't a valid branch name or commit SHA before reaching any backend. Patch landed 88 days 5 hours 8 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/209 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/209 Wed, 27 May 2026 22:18:55 GMT In the ruler export endpoints, a user with folder read access (folders:read) but without rule-level access (alert.rules:read) could enumerate and read alert rules from folders they should be denied access to. In getRulesWithFolderFullPathInFolders, when explicit folderUIDs were provided, the old code only checked folder visibility but not rule-level authorization; it silently dropped inaccessible folders instead of denying — but the actual searchAuthorizedAlertRules call was passed the raw folderUIDs list rather than the filtered query.NamespaceUIDs. In getRuleGroupWithFolderFullPath, lacking rule access caused an ErrAlertRuleNotFound which mapped to 500 rather than 403, leaking information. The patch adds explicit AuthorizeAccessInFolder checks before rule retrieval. Patch landed 83 days 20 hours 51 minutes before CVE-2026-17183 was published. high confirmed CVE-2026-17183 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/208 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/208 Wed, 27 May 2026 21:33:11 GMT The `PatchLibraryElement` endpoint allowed any user with `library.panels:write` permission on a library element to move it to any folder, including folders they cannot write to or even see. The route-level guard only checked write permission on the element itself, not create permission on the destination folder. The patch adds an explicit `library.panels:create` evaluation on the destination folder UID before allowing the move. Patch landed 88 days 18 hours 37 minutes before CVE-2026-17033 was published. medium confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/207 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/207 Wed, 27 May 2026 19:15:15 GMT The `isPublicURL` function used naive string matching to determine if a URL is public, allowing an attacker to bypass webhook registration restrictions. Specifically, `strings.Contains(url, "localhost")` would return true for legitimate public hosts like `notlocalhost.grafana.com`, blocking valid webhooks, but more critically the incomplete RFC1918 check (only `172.16.` prefix, missing `172.17`-`172.31`) meant Grafana could be tricked into registering webhooks pointing to internal/private infrastructure in the 172.17-172.31 range, potentially enabling SSRF-like scenarios where external webhook providers attempt to call back to internal services. The patch replaces string matching with proper URL parsing and CIDR range checks. Patch landed 96 days 3 hours 8 minutes before CVE-2026-19197 was published. medium confirmed CVE-2026-19197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/205 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/205 Wed, 27 May 2026 18:16:05 GMT The webhook endpoint's `Authorize` method returns `DecisionAllow` unconditionally (to allow anonymous GitHub webhook delivery), and the endpoint previously accepted both GET and POST methods. This allowed unauthenticated callers to use the GET method to enumerate repository existence and webhook configuration state by observing different HTTP response codes (404 for non-existent repos, 400 for repos without webhooks, 401 for repos with webhooks when HMAC validation fails). The patch removes GET from `ConnectMethods()` so only POST is accepted. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/206 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/206 Wed, 27 May 2026 18:16:27 GMT Before the patch, when a user updated a repository's URL, the system would automatically copy the existing stored authentication token to the new repository configuration (via CopySecureValues) without requiring a new token. This allowed an attacker or unauthorized user to pivot a repository's URL to a different target while reusing a valid stored token, potentially using the Grafana instance's credentials to authenticate against an attacker-controlled or unintended repository. The patch adds a check that rejects update operations where the URL changes but no new token is provided. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/204 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/204 Wed, 27 May 2026 13:32:37 GMT The provisioning files API only checked permissions on the resource's current database location when updating an existing resource, but never verified permissions on the destination folder when moving a resource to a different path. This allowed a user with write access to folder A to move any resource into folder B (which they have no access to) simply by writing the file to folder B's path via the provisioning files API. The patch adds a dual permission check: both the source (existing DB location) and destination folder must be authorized before a cross-folder move is permitted. Patch landed 89 days 2 hours 35 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/203 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/203 Wed, 27 May 2026 12:03:21 GMT Before the patch, the apistore client had a no-op optimization that skipped the update call to unified storage entirely when the request body bytes were identical to the existing resource. This meant that permission/RBAC checks were never performed for no-op updates, allowing users without write permissions to receive a 200 OK response when sending a PUT/PATCH with identical bytes. The patch moves the no-op check to the server side, where RBAC is enforced even when the bytes are unchanged. Patch landed 26 days 6 hours 40 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/202 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/202 Wed, 27 May 2026 10:47:26 GMT Before this patch, the `authzLimitedClient` allowlist did not include `iam.grafana.app/users`, meaning RBAC enforcement was not applied to user search queries in unified storage. A user with any access to the search endpoint could retrieve all users without having the appropriate scoped permissions, bypassing access control restrictions. The patch adds `iam.grafana.app/users` to the allowlist so that RBAC is enforced when filtering user search results. Patch landed 89 days 5 hours 26 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/199 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/199 Wed, 27 May 2026 05:12:18 GMT The `FolderReadmePanel.tsx` component rendered markdown content using `dangerouslySetInnerHTML` after processing it through `rewriteRelativeMarkdownLinks()`, which performs DOM manipulation that can mutate sanitized HTML into executable content (mXSS). The patch adds a second `textUtil.sanitize()` (DOMPurify) call after the DOM round-trip to re-sanitize the HTML before injection. Additionally, server-sourced URLs in `PullRequestButtons.tsx`, `RepositoryActions.tsx`, `RepositoryOverview.tsx`, and `ResourceTreeView.tsx` were passed directly to `LinkButton`/`window.open` without sanitization, allowing `javascript:` protocol URLs from a malicious server response to execute arbitrary JavaScript. Patch landed 89 days 10 hours 59 minutes before CVE-2026-17033 was published. high confirmed CVE-2026-17033 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/197 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/197 Tue, 26 May 2026 16:04:33 GMT The Watch RPC in Grafana's Unified Storage compiled an ItemChecker for per-item authorization and applied it to streamed events, but the initial-events backfill path (when SendInitialEvents=true) emitted every item from the backend without consulting the checker. This allowed any user who could issue a Watch request with SendInitialEvents=true to receive all resources in the namespace, regardless of per-item folder-based authorization restrictions. The patch adds `if !checker(iter.Name(), iter.Folder()) { continue }` inside the ListIterator callback so backfill honors the same per-item authorization as the live event stream. Patch landed 45 days 3 hours 33 minutes before CVE-2026-33382 was published. high confirmed CVE-2026-33382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/165 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/165 Mon, 04 May 2026 16:51:22 GMT Before the patch, any user or service account could modify the `ownerReferences` field of a SecureValue during an update operation. This allowed unprivileged users to convert a shared secure value (with an owner reference linking it to a data source or other resource) into an inline one or vice versa, potentially bypassing access control policies that depend on owner references to determine secret scope and access. The patch restricts `ownerReferences` mutations to only `AccessPolicy` identity types, preserving the existing references for all other callers. Patch landed 9 days 5 hours 19 minutes before CVE-2026-33381 was published. medium confirmed CVE-2026-33381 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/159 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/159 Tue, 28 Apr 2026 18:25:57 GMT The original `handleRedirectTo` function in `app.ts` consumed a stored redirect URL from sessionStorage after login without checking whether the URL belonged to the same origin. An attacker could craft a login URL containing `?redirectTo=https://evil.com/phishing` to store a cross-origin URL, which would then be passed directly to `locationService.replace()` after the user logged in, redirecting them to an attacker-controlled site. The patch adds an origin check using `new URL()` to ensure only same-origin redirects are followed via frontend navigation. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/138 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/138 Fri, 24 Apr 2026 15:31:32 GMT The UpdateAdminConfiguration function used xorm's fluent Where+Update(struct) pattern, but xorm resolves the target row by primary key when a struct is passed to Update(), silently ignoring the WHERE org_id clause. This caused all rows in the ngalert_configuration table to be updated when multiple organizations existed, allowing one org's configuration update to overwrite alert routing settings for all other orgs. The fix fetches the existing row first to get its primary key, then uses .ID() to scope the UPDATE to exactly that one record. high confirmed CVE-2026-21727 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/125 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/125 Mon, 30 Mar 2026 12:36:49 GMT The OFREP endpoint's `validateNamespace` function used `io.ReadAll(r.Body)` without any size limit, allowing an attacker to send arbitrarily large request bodies that would be fully read into memory. This could exhaust server memory and cause a denial of service. The fix applies `http.MaxBytesReader` to limit the body to 1 MiB before reading. medium confirmed CVE-2026-27880 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/123 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/123 Fri, 27 Mar 2026 14:45:04 GMT The fill resampling feature in Grafana's SQL datasources (MySQL, PostgreSQL, MSSQL) could be exploited to cause excessive memory allocation. By crafting a query with a very large time range and a very small fill interval (e.g., time range spanning years with millisecond intervals), an attacker could trigger `sqlutil.ResampleWideFrame` to allocate an enormous number of data points, exhausting server memory and causing a denial of service. The patch adds a guard that skips the fill operation if the number of fill points would exceed the configured row limit. Patch landed 87 days 3 hours 56 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/122 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/122 Fri, 27 Mar 2026 08:29:30 GMT When a user creates a Kubernetes resource containing inline secure values (raw secrets) via kubectl apply, the kubectl client automatically stores the full object including the raw secret value in the `kubectl.kubernetes.io/last-applied-configuration` annotation. This annotation is persisted in the API server and can be read back by anyone with read access to the resource, effectively leaking the raw secret value. The patch clears this annotation when a raw secret is detected in the inline secure values section, preventing the secret from being stored in plaintext in the annotation. Patch landed 87 days 10 hours 18 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/120 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/120 Thu, 26 Mar 2026 09:05:25 GMT Before this patch, the Kubernetes-style IAM API endpoint `/apis/iam.grafana.app/v0alpha1/namespaces/{ns}/users/{name}/teams` used the generic `ResourceAuthorizer` which only checked `get` permission on the `users` resource itself, but did not properly enforce the `teams` subresource authorization. According to the commit, the RBAC service would ignore the 'teams' subresource check, meaning any user with generic `users:read` permission could potentially access team membership data for users they shouldn't be able to see. The patch adds a dedicated `UserAuthorizer` that explicitly checks `get` permission on the parent user when the `teams` subresource is requested. Patch landed 88 days 9 hours 53 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/119 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/119 Wed, 25 Mar 2026 16:21:48 GMT The `/api/alertmanager/grafana/api/v2/status` endpoint was protected by the `alert.notifications:read` permission, which is granted to Viewers and Editors by default. This allowed any authenticated user (including low-privileged Viewers) to access Alertmanager system status information including routing configuration, receivers configuration, and other sensitive system details. The patch replaces this with a new dedicated `alert.notifications.system-status:read` permission that is only granted to Admin users. Patch landed 89 days 2 hours 41 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/118 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/118 Wed, 25 Mar 2026 14:48:37 GMT Before the patch, the `validateWriteAccess` function did not handle `JobActionFixFolderMetadata` in its switch statement, meaning it fell through to the `default` case which applies no ref-based restriction. This allowed users to trigger a fix-folder-metadata job that would write directly to the default/main branch even when the repository was configured with only a 'branch' workflow (meaning the default branch should be read-only). The patch adds the missing case to extract the target ref from `FixFolderMetadata.Ref` and apply proper write permission checks. Patch landed 89 days 4 hours 2 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/89 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/89 Fri, 20 Mar 2026 23:04:40 GMT Before this patch, the GET /api/alertmanager/grafana/config/api/v1/alerts endpoint (which returns the raw Alertmanager configuration blob, potentially containing sensitive credentials like SMTP passwords, webhook secrets, and API tokens) was accessible to any user with the broad 'alert.notifications:read' permission, which was granted to Viewers and Editors. Similarly, GET /config/history and POST /config/history/{id}/_activate were accessible to users with alert.notifications:read/write. The patch restricts these endpoints to admin-only via new fine-grained RBAC actions (alert.notifications.config-history:read/write). Patch landed 93 days 19 hours 31 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/86 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/86 Thu, 19 Mar 2026 11:55:47 GMT The Grafana short URL feature allowed authenticated users to create short URLs with arbitrary target paths, including external URLs like `http://evil.com` or protocol-relative URLs like `//evil.com`. When a victim clicked a Grafana short URL, they would be silently redirected to the attacker-controlled external domain. The patch adds validation at both creation time and redirect time to ensure paths are always relative and cannot contain schemes, protocol-relative prefixes, or other external URL patterns. Patch landed 95 days 6 hours 49 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/83 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/83 Wed, 18 Mar 2026 11:30:36 GMT Before the patch, a resource manager could be changed directly from one manager to another (e.g., from repo:abc to terraform:xyz) in a single update operation without going through a remove-then-add workflow. This allowed one management system (e.g., Terraform) to silently take over resources managed by another system (e.g., a Git repository), potentially leading to unauthorized control over managed resources and unpredictable reconciliation conflicts. The patch adds an explicit check that blocks any update where both old and new objects have a manager set but with different values, returning HTTP 403. Patch landed 96 days 7 hours 16 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/82 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/82 Tue, 17 Mar 2026 23:42:42 GMT Before this patch, the Grafana Live push endpoint (`/api/live/push/:streamId`) had no RBAC authorization check, allowing any authenticated user (including Viewers) to push metrics and events to Grafana Live streams. The patch adds an `authorize(ac.EvalPermission(ac.ActionLivePush))` middleware that restricts this endpoint to users with the `live:push` permission (granted to Editors and Admins by default). Patch landed 96 days 19 hours 5 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/80 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/80 Tue, 17 Mar 2026 19:06:19 GMT The MSSQL connection string was built by directly concatenating the username and password without escaping special characters. Since semicolons are used as key-value delimiters in the connection string, a password containing a semicolon would be truncated at the semicolon, allowing authentication bypass or connection to unintended databases. For example, a password like `StrongPass;database=other` would cause the driver to parse `database=other` as a separate connection string parameter. Patch landed 96 days 23 hours 58 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/79 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/79 Tue, 17 Mar 2026 15:19:41 GMT The provisioning API's `UpdateContactPoint` endpoint did not perform authorization checks for protected fields (e.g., webhook URLs, API keys) before the patch. Any user with access to the provisioning API could modify protected/sensitive fields in contact points without the required `receivers:update.protected` permission, bypassing the security controls enforced by the regular receiver API. The patch adds a `checkProtectedFields` method that verifies the user has appropriate permissions before allowing modifications to protected fields. Patch landed 9 days 6 hours 25 minutes before CVE-2026-21724 was published. high confirmed CVE-2026-21724 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/74 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/74 Mon, 16 Mar 2026 23:39:58 GMT Before this patch, the Kubernetes API endpoints for dashboard snapshots (GET, LIST, DELETE, POST /create, DELETE /delete/{deleteKey}, GET /settings) used a default `ServiceAuthorizer` that did not enforce RBAC permissions for snapshot resources. Any authenticated user, regardless of their assigned permissions, could read, list, create, and delete snapshots. The patch adds a `SnapshotAuthorizer` that maps K8s verbs to Grafana RBAC actions (`snapshots:read`, `snapshots:create`, `snapshots:delete`) and applies RBAC checks to the custom HTTP routes as well. Patch landed 97 days 19 hours 3 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/73 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/73 Mon, 16 Mar 2026 19:56:58 GMT Public dashboard CRUD endpoints (Delete, Update, ExistsEnabledByDashboardUid) were only checking the user's role/permissions but not validating that the public dashboard being operated on belonged to the same organization as the requesting user. This allowed an authenticated user with Editor+ permissions in Org B to delete, update, or check the existence of public dashboards belonging to Org A, without having access to the source dashboard. The patch adds org_id checks to all relevant database queries to enforce org isolation. Patch landed 97 days 22 hours 39 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/47 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/47 Mon, 23 Feb 2026 10:32:22 GMT The ValidateRedirectTo function was vulnerable to open redirect attacks through URL fragments. Attackers could bypass path validation by using URL fragments containing dangerous patterns like '../' or '//', which were not sanitized before the redirect. The patch fixes this by validating fragments and returning a sanitized URL string instead of the original user input. Patch landed 119 days 8 hours 19 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/41 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/41 Thu, 19 Feb 2026 18:31:51 GMT The code was truncating SHA256 hashes to only 10 characters when generating secret names, dramatically increasing collision probability from negligible to ~1 in 16^10. This allows attackers to craft field names that collide with existing secret field names, potentially accessing or modifying secrets they shouldn't have access to. Patch landed 123 days 11 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/35 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/35 Thu, 19 Feb 2026 10:13:09 GMT The code had a fallback authentication mechanism that would allow any request to bypass authorization checks when the primary authenticator failed. The fallback would accept requests with only namespace validation, effectively allowing unauthorized access to resources. Patch landed 123 days 8 hours 28 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/34 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/34 Wed, 18 Feb 2026 22:42:29 GMT The scope resolver cache was not invalidated when datasources were deleted, causing stale name-to-UID mappings. When a datasource was deleted and a new one created with the same name, the cached entry would resolve to the deleted datasource's UID, leading to incorrect authorization decisions. The patch fixes this by invalidating the cache entry for the datasource name scope during deletion. Patch landed 6 days 17 hours 5 minutes before CVE-2026-21725 was published. medium confirmed CVE-2026-21725 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/31 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/31 Wed, 18 Feb 2026 12:05:51 GMT The audit logging configuration was exposing sensitive data source request and response bodies by default. This could lead to credentials, API keys, and sensitive query data being logged in plaintext audit files accessible to system administrators. Patch landed 124 days 6 hours 38 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/29 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/29 Tue, 17 Feb 2026 16:03:27 GMT The rolebindings API was accessible to all authenticated users without proper authorization checks. This allowed any user to potentially view, modify, or create role bindings, leading to privilege escalation. The patch restricts access to only access policy identities. Patch landed 125 days 2 hours 43 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/24 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/24 Mon, 16 Feb 2026 14:33:20 GMT The code incorrectly assigned key functions for namespaced and cluster-scoped resources, causing namespaced resources to use cluster-scoped key functions and vice versa. This could allow unauthorized access to resources across namespace boundaries by manipulating resource keys. Patch landed 126 days 4 hours 5 minutes before CVE-2026-42127 was published. high confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/22 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/22 Mon, 16 Feb 2026 10:04:29 GMT The endpoint allowed any authenticated user to access team member information without proper authorization checks. The patch adds a permission check requiring 'GetPermissions' verb on the Team resource before returning member data. Patch landed 126 days 8 hours 34 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/20 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/20 Mon, 16 Feb 2026 07:36:22 GMT The files API endpoints were not enforcing quota limits, allowing authenticated users to bypass resource quotas and create unlimited files/dashboards. This could lead to resource exhaustion and denial of service. The patch adds quota checks before allowing POST/PUT operations on files. Patch landed 126 days 11 hours 3 minutes before CVE-2026-42127 was published. medium confirmed CVE-2026-42127 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/10 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/10 Wed, 11 Feb 2026 12:26:10 GMT The code was vulnerable to Cross-Site Scripting (XSS) by directly rendering user-controlled data via dangerouslySetInnerHTML without sanitization. Malicious trace data could inject JavaScript that would execute in users' browsers. The patch fixes this by sanitizing HTML content with DOMPurify before rendering. Patch landed 21 hours 29 minutes before CVE-2025-41117 was published. medium confirmed CVE-2025-41117 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/11 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/11 Wed, 11 Feb 2026 12:26:16 GMT The vulnerability allows attackers to bypass time range restrictions on public dashboards when time selection is disabled. By manipulating request time parameters, attackers can access annotations outside the intended dashboard time range, potentially exposing sensitive data from unauthorized time periods. Patch landed 21 hours 29 minutes before CVE-2026-21722 was published. high confirmed CVE-2026-21722 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/9 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/9 Wed, 11 Feb 2026 00:53:34 GMT The code forwards arbitrary HTTP headers from incoming requests to outgoing gRPC calls without proper validation or sanitization. An attacker can inject malicious headers that could be used to bypass security controls, manipulate downstream services, or perform request smuggling attacks. Patch landed 44 days 14 hours 53 minutes before CVE-2026-27876 was published. medium confirmed CVE-2026-27876