AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

CLEANSTART-2026-HJ64426 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-BY71452 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785563141)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785563141 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

EUVD-2026-84806

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...

CVE-2026-63627 mppx: Gas Draining with padding

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...

CVE-2026-87119 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...

PT-2026-96708

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description An authentication bypass via capture-replay allows an attacker with a captured subscription activation credential to repeatedly charge a payer. The issue occurs because the payer signs a...

CLEANSTART-2026-FD99919 Security fix for CVE-2025-11065 applied in: fulcio 1.7.1-r0, fulcio-fips 1.7.1-r1, istio 1.27.1-r0, istio 1.28.7-r0, spark-operator 2.2.1-r0, tempo 2.7.2-r0, tempo 2.8.3-r0, tempo-fips 2.7.2-r0, tempo-fips 2.8.3-r0, tempo-fips 2.9.1-r0

CVE-2025-11065 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LK18323 Security fix for CVE-2026-32287 applied in: grafana-alloy 1.13.1-r1, grafana-alloy 1.14.1-r0, tempo 2.10.3-r0, tempo 2.7.2-r0, tempo 2.8.3-r0, tempo 2.9.1-r0, tempo-fips 2.10.3-r0, tempo-fips 2.7.2-r0, tempo-fips 2.8.3-r0, tempo-fips 2.9.1-r0

CVE-2026-32287 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MG98376 Security fix for CVE-2026-28377 applied in: grafana 12.2.10-r1, grafana 12.3.10-r1, grafana 12.4.7-r1, grafana 12.4.9-r1, grafana 13.0.5-r1, grafana 13.0.7-r1, grafana 13.1.0-r3, pmm 3.5.0-r0, tempo 2.7.2-r2, tempo 2.8.3-r0

CVE-2026-28377 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AX88434 Security fix for CVE-2025-29786 applied in: argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, tempo-fips 2.7.2-r0

CVE-2025-29786 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MY58783 Security fix for CVE-2026-43871 applied in: tempo 3.0.3-r1, vault 1.21.4-r11, vault 2.0.4-r5

CVE-2026-43871 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VK48825 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

Multiple security vulnerabilities affect the grafana package. Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. See references for individual vulnerability details...

CVE-2026-88255

CVE-2026-88255 is an improper validation of unsafe equivalence in input in ZenHive mpp (versions 0.2.0 through before 0.16.2). The root cause lies in MPP.Methods.Tempo, where the pre-broadcast dedup reserve (reserve_hash_atomic/2) keys on the caller-supplied raw hex (tx.raw) rather than a canonic...

EUVD-2026-80256

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...

EEF-CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

Summary Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/...