openSUSE-SU-2026:21351-1: moderate: Security update for grafana

openSUSE security update: security update for grafana
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21351-1
Rating: moderate
References:

  * bsc#1262187
  * bsc#1263272



Cross-References:

  * CVE-2025-12141
  * CVE-2026-21725
  * CVE-2026-41607



CVSS scores:

  * CVE-2025-12141 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2025-12141 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
  * CVE-2026-21725 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L
  * CVE-2026-21725 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-41607 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
  * CVE-2026-41607 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 3 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for grafana fixes the following issues:

Changes in grafana:

- Add UI web assets as additional source tarball

- Update to version 12.4.5 (jsc#PED-16512):
  * Datasources: return 400 when payload UID does not match URL UID
    in PUT /api/datasources/uid/:uid

- Update to version 12.4.4:
  * Security and quality updates.
  * Various bug fixes and enhancements.

- Update to version 12.4.3:
  * Analytics: Keep internal dashboard id.
  * Go: Update to 1.25.9.
  * Reporting: Correctly apply appSubURL to report settings
               requests.
  * Alerting: Document Grafana HA Alertmanager cluster metrics
              prefix change.

- Update to version 12.4.2:
  * Various bug fixes and performance improvements.
  * Dependency updates to core plugins and UI libraries.

- Update to version 12.4.1:
  * Bug fixes and minor quality-of-life enhancements.
  * Updates to data source provisioning and dashboard schemas.

- Update to version 12.4.0:
  * Introduced dynamic dashboards in public preview.
  * Added a new side toolbar that replaces the second top toolbar
    to provide additional vertical space.
  * Added the ability to create dashboards from templates using
    sample data.
  * Revamped the gauge visualization with rounded bars,
    configurable bar thickness, and endpoint markers.
  * Added support to map one variable to multiple values.
  * CVE-2025-12141: Fixed information leakage in Grafana Alerting
    (bsc#1262187)

- Update to version 12.3.0:
  * Released a completely redesigned logs visualization.
  * Added the ability to export dashboards directly as PNG images.
  * Introduced an interactive learning experience within the
    Grafana UI.
  * Added a Switch template variable type to quickly toggle between
    values in queries.
  * Added functionality to style table cells using CSS properties
    via the field cell option.

- Update to version 12.2.0:
  * Routine feature enhancements, minor bug fixes, and security
    patches.

- Update to version 12.1.0:
  * Added support for Entra Workload Identity to enhance
    authentication capabilities with federated credentials.
  * Redesigned the alert rule list page.
  * Renamed Mute Timings to Active Time Intervals in Grafana
    Alerting.
  * Added support for Service Account Impersonation in the BigQuery
    data source.
  * Introduced the Grafana Advisor in public preview.

- Update to version 12.0.0:
  * BREAKING: Removed AngularJS and all deprecated UI Extensions
    APIs.
  * BREAKING: Enforced stricter version compatibility checks in
    plugin CLI install commands.
  * BREAKING: Enabled the failWrongDSUID feature flag by default,
    which rejects data sources with incorrect UIDs.
  * MIGRATION: Triggered a full-table rewrite for the annotation
    table, which may temporarily increase disk usage.
  * Introduced a new dashboard schema to replace the original
    single grid layout.

- CVE-2026-41607: Fix potential information disclosure in Apache
  Thrift (bsc#1263272)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-416=1

Package List:

- openSUSE Leap 16.0:

  grafana-12.4.5-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-12141.html
  * https://www.suse.com/security/cve/CVE-2026-21725.html
  * https://www.suse.com/security/cve/CVE-2026-41607.html