Important: Grafana security update
Type/Severity
NetEye Product Security has rated this update as having a Medium security impact.
Topic
Updates for the grafana packages are now available for NetEye 4.
Security Fix for NetEye 4.50
12.4.13_neteye3.31.5-1
CVEs
- CVE-2026-15577
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVE-2026-33374
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-93294
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Two of the three CVEs are reachable by any low-privileged authenticated user: an oversized request to the Prometheus rule conversion API can exhaust memory and crash Grafana, and the Git Sync provisioning API lets a read-only user modify a connection’s configuration (exposed on Grafana 12.4 only when the experimental provisioning toggle is enabled). The third CVE is a confused deputy flaw in the Azure Monitor data source, whose resource proxy lets a user with query access call Azure Resource Manager APIs beyond those Grafana needs, using the data source’s own Azure identity. Together these vulnerabilities can lead to a Grafana outage, unauthorized configuration changes, or information disclosure where Azure Monitor data sources are used.
Affected Products
All NetEye 4.x versions.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/grafana/grafana/releases/tag/v12.4.13
- https://grafana.com/security/security-advisories/cve-2026-15577
- https://grafana.com/security/security-advisories/cve-2026-33374
- https://grafana.com/security/security-advisories/cve-2026-93294
Patrick Harasser
Author
