Resource management error in Grafana - CVE-2026-21720

Vulnerability identifier: #VU122160

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21720

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when caching avatars from the Gravatar service API. If such a request times out after 3 seconds a Goroutine is left running consuming system resources.

Grafana
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
mgrctl
mgrctl-lang
mgrctl-zsh-completion
mgrctl-bash-completion
mgrctl-debuginfo
firewalld-prometheus-config
golang-github-QubitProducts-exporter_exporter
golang-github-prometheus-promu
golang-github-prometheus-promu-debuginfo
prometheus-blackbox_exporter
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
golang-github-boynux-squid_exporter-debuginfo
golang-github-boynux-squid_exporter
golang-github-prometheus-prometheus
spacecmd
grafana-debuginfo
grafana

Install updates from vendor's website.

Grafana - addressed in versions 11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01, 12.2.3+security-01, 12.3.1+security-01
mgrctl - update to 0.1.38-150000.1.30.1
mgrctl-lang - update to 0.1.38-150000.1.30.1
mgrctl-zsh-completion - update to 0.1.38-150000.1.30.1
mgrctl-bash-completion - update to 0.1.38-150000.1.30.1
mgrctl-debuginfo - update to 0.1.38-150000.1.30.1
firewalld-prometheus-config - update to 0.1-150000.3.67.1
golang-github-QubitProducts-exporter_exporter - update to 0.4.0-150000.1.21.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - update to 0.26.0-150000.1.30.2
golang-github-lusitaniae-apache_exporter - update to 1.0.10-150000.1.26.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.10-150000.1.26.1
dracut-saltboot - update to 1.1.0-150000.1.65.1
golang-github-boynux-squid_exporter-debuginfo - update to 1.13.0-150000.1.12.1
golang-github-boynux-squid_exporter - update to 1.13.0-150000.1.12.1
golang-github-prometheus-prometheus - update to 3.5.0-150000.3.67.1
spacecmd - update to 5.0.15-150000.3.142.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1

• https://grafana.com/security/security-advisories/cve-2026-21720/

• Multiple vulnerabilities in Grafana
• SUSE update for grafana
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Client Tools