PT-2026-3006 · Grafana · Grafana

Published 2026-01-15 · Updated 2026-01-17 · CVE-2026-22639

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 10.4.19+security-01 Grafana versions prior to 11.2.10+security-01 Grafana versions prior to 11.3.7+security-01 Grafana versions prior to 11.4.5+security-01 Grafana versions prior to 11.5.5+security-01 Grafana versions prior to 11.6.2+security-01 Grafana versions prior to 12.0.1+security-01

Description Grafana, an open-source platform for monitoring and observability, had an issue with its Alerting DingDing integration. The integration was not adequately protected, potentially exposing it to users with Viewer permission.

Recommendations Update to Grafana version 10.4.19+security-01 or later. Update to Grafana version 11.2.10+security-01 or later. Update to Grafana version 11.3.7+security-01 or later. Update to Grafana version 11.4.5+security-01 or later. Update to Grafana version 11.5.5+security-01 or later. Update to Grafana version 11.6.2+security-01 or later. Update to Grafana version 12.0.1+security-01 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-00579

CVE-2026-22639

Affected Products

Grafana

References · 9

• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22639 · Security Note
• https://bdu.fstec.ru/vul/2026-00579 · Security Note
• https://first.org/cvss/calculator/3.1 · Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.json · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://sick.com/psirt · Note
• https://twitter.com/CVEnew/status/2012490363504583035 · Twitter Post
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note