CVE-2026-21722
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Feb 12, 2026
CISA due date
—
The record
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-11.4 | 0 | 11.4.8-r3 |
| Chainguard | grafana-fips-11.5 | 0 | 11.5.10-r2 |
| Chainguard | grafana-fips-12.0 | 0 | 12.0.10-r0 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 0 | 11.6.11-150200.3.83.1 |
| SUSE:Manager Client Tools 15 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools 15 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| SUSE:Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 0 | 3.5.0-150000.3.67.1 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.6.11-150000.1.90.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools 15 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| SUSE:Manager Client Tools 15 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools for SLE Micro 5 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| Wolfi | grafana-11.4 | 0 | 11.4.8-r3 |
| openSUSE:Leap 15.6 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| openSUSE:Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| openSUSE:Leap 15.6 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| openSUSE:Leap 15.6 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| openSUSE:Leap 15.6 | grafana | 0 | 11.6.11-150200.3.83.1 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| openSUSE:Leap 15.6 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. Also affects grafana-11.4
- CVE-2026-21721 The dashboard permissions API does not verify the target dashboard scope and only checks… Also affects grafana-11.4
- CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.4
- CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory… Also affects grafana-fips-12.0
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects grafana-fips-12.0
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects grafana-fips-12.0
- CVE-2026-27606 Rollup is a module bundler for JavaScript. Also affects golang-github-prometheus-promu
- CVE-2026-1615 Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection… Also affects golang-github-prometheus-promu