Docker Security Scanner / grafana/grafana / 13.1.0 / detailed

grafana/grafana:13.1.0

HIGH · 77/100 · now ✓ Trusted source · Verified Publisher · Grafana Labs Scanned Jul 9, 2026 · digest sha256:9ed…13.1.0 (multi-arch)

/100

now

Current threat score

HIGH

45 High findings · 0 Critical

The image as shipped today, before any hardening — see the last box below for the score after all measures.

Verdict & recommended action

Risky as shipped

Deployed as shipped, this is a risky container: 83 vulnerability findings, a writable filesystem and the full Linux capability set — its one good default is running non-root (uid 472). An attacker who gains any foothold can persist and, through a Go os.Root flaw live on the default path, reach files outside Grafana’s directories; 37 vulnerable OS libraries add a ready-made toolkit for an intruder. Do not deploy it in this state.

Concretely, running it unmodified: 37 findings in curl / libcurl / c-ares never threaten Grafana itself, but they arm any attacker who reaches a shell — and fail every compliance scan. 36 parser flaws go live once a zipkin or elasticsearch datasource is configured — a compromised backend can crash the service. 2 stdlib flaws run on default paths — the os.Root symlink escape (left open by the writable filesystem) and a TLS ECH privacy leak. 3 wake up only if the experimental zanzana flag is enabled; 5 are truly absent from the binaries. None are in CISA KEV and EPSS is low — the state of the exploit market, not a property of this image.

Total findings

as scanned · 56 unique CVEs

→ CVE log

−

Removable

unused OS packages — deleted

→ Hardening

−

Not reachable

code not linked

→ Reachability

−

Closed by controls

reachable, neutralised

→ Compensating controls

/100

SAFE risk

threat score after all measures

Tip: each box has a button to its section — Removable → Hardening, Not reachable → Reachability, Closed by controls → Compensating controls. The last figure is a score, not a count.

What the playbook contains

1
Eligibility gate
confirms the image is Alpine + statically-linked Go before anything else runs
2
Hardening
hardened Dockerfile — patch the OS, delete the unused packages — plus the non-root, read-only runtime flags
3
Compensating controls
each control mapped to your configuration: unused plugins, off-by-default features, network isolation

Everything an AI agent needs to run the six steps around this button end-to-end — machine-runnable, in order.

Note: the playbook neutralises — it does not delete. 41 findings’ code still ships in the binary until a Grafana upgrade.

4
Reachability re-check
govulncheck + go tool nm re-run against the hardened image to confirm what is actually left
5
VEX & SBOM
a machine-readable justification per CVE, so your own scanner agrees with the analysis
6
Functional tests & parity gate
before/after tests proving the hardening broke nothing — the gate the run ends on

Hardening

Four steps that clear the OS layer before any Go analysis.

−37

Removable — deleted

Remain → reachability

Patch the OS layer

apk upgrade brings every Alpine package to its fixed version — a baseline that keeps the OS clean.

baseline

Delete unused packages

Remove curl / libcurl / c-ares — the static Go binary never links them, so deleting them is safe.

−37 findings (24 High)

Pin the non-root user

The image already defaults to the built-in grafana user (uid 472) — pin it explicitly (runAsNonRoot / user: 472) so no override reintroduces root; step 4 relies on it.

already default — pin it

Lock down the runtime

--read-only rootfs, --cap-drop ALL, --security-opt no-new-privileges — this is what neutralises the os.Root finding.

neutralises 1 (os.Root)

Result: 83 → 46 findings · threat band HIGH → ELEVATED. What remains is compiled into the Go binaries — reachability decides what matters next.

Reachability analysis

Buckets ordered by what needs attention first. Each Go finding is classified by whether its vulnerable code is actually reachable.

−5

Proven not reachable

Remain → controls

Method: go tool nm (package linkage) + govulncheck binary & source (symbol presence + call graph) + a live-container check that off-by-default features are off.

Always reachable2

On the execution path in the core binary

Live code in the main grafana binary that runs regardless of configuration. Both are niche stdlib issues (stdlib×2 — os.Root symlink handling, Encrypted Client Hello) with no rated severity (Unknown).

Reachable only if used36

Inside optional datasource plugins

stdlib & x/net parsers (stdlib×27, golang.org/x/net×7, go.opentelemetry.io/otel×1, go.opentelemetry.io/otel/sdk×1) inside the bundled zipkin / elasticsearch datasource plugins. This code executes only when that datasource is configured and queried; the malicious input would have to come from the datasource backend. 34 of the 36 are proven by symbol presence; the 2 otel findings lack govulncheck data and are counted as reachable out of caution.

Conditional3

Reachable only if an off-by-default feature is on

OpenFGA authorization (github.com/openfga/openfga×3) — code that exists only when the experimental zanzana flag is enabled. It is off by default (verified on a live container), so these paths are dormant.

Not reachable5

Vulnerable code is not linked into the image

Proven absent by symbol analysis: Tempo — only protobuf types are linked, not the vulnerable server; OpenPGP — 0 symbols present.

Findings by component

The coloured bar shows each component’s severity mix: High Medium Low Unknown

OS · Alpine 3.24.1 · removable / patch

apk / no Go

plugin · zipkin · 29 reachable

go1.25.7 · stripped

core · grafana binary · 2 reachable

go1.26.4 · not stripped

plugin · elasticsearch · 5 reachable

go1.26.3 · stripped

Compensating controls

Follow the steps in order. Controls stop the code from being exploited — they don’t delete it.

−41

Closed by controls

Unresolved remain

Don’t configure unused datasource plugins

Plugin parsing code runs only when that datasource is queried. Skip Zipkin/ES tracing and their findings never enter the execution path.

closes 36

Keep datasource backends trusted & internal

The reachable DoS bugs need a malicious backend response. Put Zipkin/ES/Prometheus behind mTLS on a segmented network — no crafted input reaches the parser.

removes the input path

Keep the Zanzana feature disabled

The 3 conditional OpenFGA findings only wake up behind the experimental zanzana flag. It is off by default — leave it off.

closes 3

Apply runtime hardening

non-root (uid 472), --read-only, --cap-drop ALL, no-new-privileges, plus --memory/--cpus limits. Most reachable findings are DoS — limits turn them into a contained restart.

caps blast radius

Deliberately not listed here: publishing a VEX and re-scanning each digest (governance — it documents these verdicts, it doesn’t block an exploit; see the CVE-log caveat) and upgrading Grafana (the true fix — it removes the code instead of neutralising it; see “What still ships in the binary”).

Deep dive — the sections below are collapsed; expand what you need

▶

What still ships in the binary

Compensating controls stop these findings from being exploited, but the vulnerable code is compiled in — the same is true for every reachable finding, and only a Grafana upgrade removes it.

Nothing exploitable remains

41 findings’ code is still in the binary — all neutralised in this deployment, cleared for good only by upgrading Grafana (which rebuilds on a current Go toolchain). Of these, all but 2 sit in code that never runs unless you enable the matching plugin or feature. The remaining 2 run on default paths, so their safety rests on the runtime hardening staying in place — worth knowing exactly what they are:

CVE-2026-39822 os.Root symlink traversal Neutralised by hardeningcore grafana binary · fixed in Go 1.25.12, 1.26.5, 1.27.0-rc.2

Running it as-is — dangerous?

Not dangerous in a normal deployment. Exploiting it needs an attacker who can already drop files into the directories Grafana opens — and the read-only, non-root container (already applied here) makes that impossible. It only becomes a concern if you mount user-writable volumes into Grafana’s working paths.

What it does & how it could be exploited

It’s a flaw in Go’s os.Root — the sandbox that keeps file access inside one directory. If a path ends in “/” and the last part is a symlink, Go follows it outside the sandbox. To use it, an attacker would plant a malicious symlink in a directory Grafana opens and get Grafana to read/write through it, reaching files outside the intended folder. No rated severity (Unknown).

CVE-2026-42505 Encrypted Client Hello privacy leak Not in usecore grafana binary · fixed in Go 1.25.12, 1.26.5, 1.27.0-rc.2

Running it as-is — dangerous?

Not dangerous. The leak only happens on TLS handshakes that use ECH — a feature Grafana never turns on. With ECH off (the default), this code never runs and nothing leaks. Revisit only if you deliberately enable ECH.

What it does & how it could be exploited

A flaw in Go’s TLS stack: when a connection uses Encrypted Client Hello (a privacy feature that hides which site you connect to), the pre-shared-key identity still leaks in the unencrypted part of the handshake, letting a passive network observer tell TLS sessions apart. It’s a privacy leak only — no data is exposed and nothing is taken over. No rated severity (Unknown).

▶

Library analysis

Every Go dependency: its role in Grafana, its findings, and the dominant reachability verdict.

Modules

Reachable-driven

Not linked

stdlib · grafana binary, elasticsearch, zipkin

Go standard library (crypto/tls, net/http, net/url, os, encoding). Version = build toolchain.

REACHABLE

13 H 9 M 1 L 6 U

golang.org/x/net · zipkin

HTML parser & HTTP/2 — exercised when parsing tracing-backend responses.

REACHABLE

4 H 3 M

github.com/openfga/openfga · grafana binary

Zanzana authorization engine (experimental feature, off by default).

CONDITIONAL

2 M 1 L

github.com/grafana/tempo · grafana binary

Tempo tracing — Grafana links only the protobuf types, not the server.

NOT REACHABLE

2 H

golang.org/x/crypto · grafana binary, elasticsearch

SSH / crypto primitives; the advisory concerns the abandoned openpgp sub-package.

NOT REACHABLE

2 U

go.opentelemetry.io/otel · zipkin

OpenTelemetry SDK — telemetry.

REVIEW

1 H

go.opentelemetry.io/otel/sdk · zipkin

OpenTelemetry SDK — telemetry.

REVIEW

1 H

golang.org/x/sys · zipkin

Low-level syscalls; Unknown-severity advisory.

NOT REACHABLE

1 U

▶

Image reputation & trust

Who publishes this image and how widely it is used — context for how much to trust the source.

5.3B

Docker pulls

3.5k

Stars

Verified

Publisher

Grafana Labs — Verified Publisher (trusted vendor). Not a Docker “Official Image”, but a vendor-maintained one, which is the norm for first-party application images.

Adoption

5,264,981,356 pulls (~5.3 billion) and 3,556 stars on Docker Hub — one of the most-used application images in existence.

Integrity

Repository status active; the scan is pinned by digest, so the analysis matches exactly what runs. Categories: Monitoring & observability, Security.

Provenance to still check

Verified-Publisher confirms the source, not a signature. For supply-chain assurance also verify a cosign signature / SBOM attestation if your policy requires it.

Verdict: trustworthy source. A verified first-party publisher with billions of pulls — the risk in this report is about the image’s age/contents, not its origin. Trust the publisher; act on the findings above.

▶

Full CVE log

All 83 findings — residual items first, then everything closed by hardening or controls.

High

Medium

Low

Unknown

Honest caveat: this count is relative to the scanner’s database at scan time — binary-mode govulncheck can flag findings Trivy doesn’t (the 13.0.3 deep-dive surfaced six such, e.g. go-pkcs12). “0 in a scanner” never means zero vulnerabilities; re-scan by digest.

CVE ID	Severity	Package	Component	Status	Fixed in	Summary
CVE-2026-11352	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability
CVE-2026-11586	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Denial of Service via WebSocket PING flood
CVE-2026-12064	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP
CVE-2026-8286	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Insecure connection establishment due to TLS configuration mismatch
CVE-2026-8925	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Double-free vulnerability in SASL authentication
CVE-2026-8927	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
CVE-2026-8932	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
CVE-2026-9079	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials
CVE-2026-9080	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback
CVE-2026-9545	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure via cached SSL session and early data
CVE-2026-9546	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to persistent Referer header
CVE-2026-9547	HIGH	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Man-in-the-middle attack via SSH host key bypass
CVE-2026-21728	HIGH	github.com/grafana/tempo v1.5.1-0.20260427112133-525d1bab07e0	core · grafana binary	Not affected	2.8.4, 2.9.2, 2.10.2	grafana/tempo: Tempo: Denial of Service via large queries
CVE-2026-28377	HIGH	github.com/grafana/tempo v1.5.1-0.20260427112133-525d1bab07e0	core · grafana binary	Not affected	2.10.3	Grafana Tempo: Grafana Tempo: Information disclosure of S3 encryption key via status config endpoint
CVE-2026-29181	HIGH	go.opentelemetry.io/otel v1.40.0	plugin · zipkin	Closed by controls	1.41.0	github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers
CVE-2026-39883	HIGH	go.opentelemetry.io/otel/sdk v1.40.0	plugin · zipkin	Closed by controls	1.43.0	github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris
CVE-2026-25681	HIGH	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
CVE-2026-27136	HIGH	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
CVE-2026-33814	HIGH	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.53.0	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
CVE-2026-39821	HIGH	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
CVE-2026-11352	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability
CVE-2026-11586	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Denial of Service via WebSocket PING flood
CVE-2026-12064	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP
CVE-2026-8286	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Insecure connection establishment due to TLS configuration mismatch
CVE-2026-8925	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Double-free vulnerability in SASL authentication
CVE-2026-8927	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to uncleared proxy authentication state
CVE-2026-8932	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
CVE-2026-9079	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials
CVE-2026-9080	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback
CVE-2026-9545	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure via cached SSL session and early data
CVE-2026-9546	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Information disclosure due to persistent Referer header
CVE-2026-9547	HIGH	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Man-in-the-middle attack via SSH host key bypass
CVE-2026-27145	HIGH	stdlib v1.26.3	plugin · elasticsearch	Closed by controls	1.25.11, 1.26.4	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
CVE-2026-42504	HIGH	stdlib v1.26.3	plugin · elasticsearch	Closed by controls	1.25.11, 1.26.4	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
CVE-2026-25679	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.8, 1.26.1	net/url: Incorrect parsing of IPv6 host literals in net/url
CVE-2026-27145	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.11, 1.26.4	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
CVE-2026-32280	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
CVE-2026-32281	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
CVE-2026-32283	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
CVE-2026-33811	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
CVE-2026-33814	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
CVE-2026-39820	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
CVE-2026-39836	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	ELSA-2026-22121: golang security update (IMPORTANT)
CVE-2026-42499	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
CVE-2026-42504	HIGH	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.11, 1.26.4	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
CVE-2026-10536	MEDIUM	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service
CVE-2026-11564	MEDIUM	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse
CVE-2026-11856	MEDIUM	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-8924	MEDIUM	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Cookie injection via malicious HTTP server using super cookies
CVE-2026-8926	MEDIUM	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Information disclosure via incorrect .netrc password lookup
CVE-2026-48096	MEDIUM	github.com/openfga/openfga v1.14.2	core · grafana binary	Closed by controls	1.16.0	OpenFGA: OpenFGA: Incorrect authorization due to cache key collision in iterator caching
CVE-2026-55689	MEDIUM	github.com/openfga/openfga v1.14.2	core · grafana binary	Closed by controls	1.18.0	OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
CVE-2026-25680	MEDIUM	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
CVE-2026-42502	MEDIUM	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
CVE-2026-42506	MEDIUM	golang.org/x/net v0.49.0	plugin · zipkin	Closed by controls	0.55.0	golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
CVE-2026-10536	MEDIUM	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service
CVE-2026-11564	MEDIUM	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse
CVE-2026-11856	MEDIUM	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-8924	MEDIUM	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Cookie injection via malicious HTTP server using super cookies
CVE-2026-8926	MEDIUM	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	curl: curl: Information disclosure via incorrect .netrc password lookup
CVE-2026-42507	MEDIUM	stdlib v1.26.3	plugin · elasticsearch	Closed by controls	1.25.11, 1.26.4	net/textproto: golang: Golang net/textproto: Misleading error messages via input injection
CVE-2026-27142	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.8, 1.26.1	html/template: URLs in meta content attribute actions are not escaped in html/template
CVE-2026-32282	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
CVE-2026-32288	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive
CVE-2026-32289	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.9, 1.26.2	html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals
CVE-2026-39823	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content
CVE-2026-39825	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls
CVE-2026-39826	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.10, 1.26.3	html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping
CVE-2026-42507	MEDIUM	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.11, 1.26.4	net/textproto: golang: Golang net/textproto: Misleading error messages via input injection
CVE-2026-8458	LOW	curl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl might in some circumstances reuse the wrong connection when as ...
CVE-2026-55170	LOW	github.com/openfga/openfga v1.14.2	core · grafana binary	Closed by controls	1.18.0	OpenFGA Improper Policy Enforcement
CVE-2026-8458	LOW	libcurl 8.20.0-r1	OS · Alpine 3.24.1	Removable	8.21.0-r0	libcurl might in some circumstances reuse the wrong connection when as ...
CVE-2026-27139	LOW	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.8, 1.26.1	os: FileInfo can escape from a Root in golang os module
CVE-2026-33630	UNKNOWN	c-ares 1.34.6-r0	OS · Alpine 3.24.1	Removable	1.34.8-r0
GO-2026-5932	UNKNOWN	golang.org/x/crypto v0.52.0	core · grafana binary	Not affected	—	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2026-5932	UNKNOWN	golang.org/x/crypto v0.52.0	plugin · elasticsearch	Not affected	—	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
CVE-2026-39824	UNKNOWN	golang.org/x/sys v0.40.0	plugin · zipkin	Not affected	0.44.0	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
CVE-2026-39822	UNKNOWN	stdlib v1.26.4	core · grafana binary	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	On Unix systems, opening a file in an os.Root improperly follows symli ...
CVE-2026-42505	UNKNOWN	stdlib v1.26.4	core · grafana binary	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	Handshakes which used Encrypted Client Hello could be de-anonymized by ...
CVE-2026-39822	UNKNOWN	stdlib v1.26.3	plugin · elasticsearch	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	On Unix systems, opening a file in an os.Root improperly follows symli ...
CVE-2026-42505	UNKNOWN	stdlib v1.26.3	plugin · elasticsearch	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	Handshakes which used Encrypted Client Hello could be de-anonymized by ...
CVE-2026-39822	UNKNOWN	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	On Unix systems, opening a file in an os.Root improperly follows symli ...
CVE-2026-42505	UNKNOWN	stdlib v1.25.7	plugin · zipkin	Closed by controls	1.25.12, 1.26.5, 1.27.0-rc.2	Handshakes which used Encrypted Client Hello could be de-anonymized by ...