GO-2026-6612 vulnerabilities

Vulnerabilities for packages: mariadb-operator, step, cluster-api, velero-plugin-for-microsoft-azure, addon-resizer, gomplate, actions-runner-controller, crossplane-provider-aws-eks, rancher-fleet, opentelemetry-collector, kpt, helm-push, dex, k8ssandra-client, yunikorn-k8shim, contour,...

CVE-2026-78663 vulnerabilities

Vulnerabilities for packages: mariadb-operator, step, cluster-api, velero-plugin-for-microsoft-azure, addon-resizer, gomplate, actions-runner-controller, crossplane-provider-aws-eks, rancher-fleet, opentelemetry-collector, kpt, helm-push, dex, k8ssandra-client, yunikorn-k8shim, contour,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: mariadb-operator, step, cluster-api, velero-plugin-for-microsoft-azure, addon-resizer, gomplate, actions-runner-controller, crossplane-provider-aws-eks, rancher-fleet, opentelemetry-collector, kpt, helm-push, dex, k8ssandra-client, yunikorn-k8shim, contour,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: mariadb-operator, step, cluster-api, velero-plugin-for-microsoft-azure, addon-resizer, gomplate, actions-runner-controller, crossplane-provider-aws-eks, rancher-fleet, opentelemetry-collector, kpt, helm-push, dex, k8ssandra-client, yunikorn-k8shim, contour,...

CLEANSTART-2026-ST96789 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: mcp-grafana, pulumi-kubernetes-operator, distribution, frankenphp-8.5, mcp-grafana-fips, opentelemetry-go-instrumentation-fips, distribution-fips, aws-otel-collector-fips, grafana-mimir, caddy, zot, google-cloud-otel-ops-collector, envoy-ai-gateway, grafana, opentofu...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: harbor-registry, datadog-agent, caddy, grafana-mimir, grafana-alloy, grafana, tempo, kots, grafana-pyroscope, aws-otel-collector, amazon-cloudwatch-agent, mcp-grafana, pulumi-kubernetes-operator, traefik, falcosidekick, fluent-bit-plugin-loki, zot, distribution, loki...

GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

Loki: Loki: Denial of Service via large limit queries

A flaw was found in Loki. A remote attacker can exploit this vulnerability by sending specially crafted queries with large limits, leading to excessive memory allocation. This can cause a Denial of Service DoS by impacting the availability of the Loki service...

CLEANSTART-2026-EI91095 Security fix for GHSA-78h2-9frx-2jm8 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DU50032 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-NA25366 Security fix for GHSA-xmrv-pmrh-hhx2 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-US79386 Security fix for GHSA-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QC55250 Security fix for GHSA-w8rr-5gcm-pp58 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WU91498 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the loki package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-UN89941 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the loki package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...