Grafana 13.1.1 CVE Issues

Grafana Installation
1

  • What Grafana version and what operating system are you using?
    13.1.1 on K8s

  • What are you trying to achieve?
    fix the following cve issues

    image
    image705×613 46.3 KB

  • How are you trying to achieve it?
    Is there any plan to fix these cve issues?

  • What happened?

  • What did you expect to happen?

  • Can you copy/paste the configuration(s) that you are having problems with?

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

  • Did you follow any online instructions? If so, what is the URL?

2

Of course. Some are already fixed, just not released yet. E.g. your first one

You can watch full OSS development GitHub - grafana/grafana: The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more. · GitHub

If you know what you are doing (at your own risk), then you can try unreleased version - nightly build e.g. Download Grafana

3

Thanks, @jangaraj .

I try to use the nightly version (docker images: grafana/grafana:nightly), but still got the following CVE:

image
image1126×626 78.7 KB

4

Which Golang version was used for nightly build today?

docker run --rm -ti --entrypoint=/bin/sh grafana/grafana:nightly -c "grep -a -E -m 1 '^go1\.[0-9]+\.[0-9]+' /usr/share/grafana/bin/grafana"
go1.26.6

Go 1.26.6

So why your scanner is showing that it is not fixed?

This security hunting doesn’t make sense. When you “fix” these current issues, then there will be new issues. So if you really need “green” security scan, then only your options is to run your own scanning/fixing every day. Good luck with that.

Majority of professionals just watch Grafana security releases and apply them - they have serious security issue fixes. If you are paid Grafana customer, then you will get notification about security releases a few day before they are public. Grafana Cloud users can have even daily releases Rolling release channels for Grafana Cloud | Grafana Labs

But more frequent security issue fixes mean more frequent app feature updates = more frequent app issues.

5

I checked the report, and it is showing the issues are from some plugins.

image
image1173×810 64.6 KB

I will check if we can remove the plugins.

Thanks, @jangaraj .

6

That table confirms it clearly → core grafana binary is on 1.26.6, matching your nightly check, but the bundled datasource plugins (Elasticsearch on 1.26.3, PostgreSQL on 1.26.4, MySQL on 1.26.5, OpenTSDB on 1.25.7) are each compiled separately and lag behind.

If you’re not using those specific bundled datasources, it’s worth trying to remove their plugin folders → they’re under /usr/share/grafana/data/plugins-bundled/<plugin-folder>/ in the image.

If you’re building a custom image on top of the official one, a RUN rm -rf layer for the unused plugin directories should do it.

Worth confirming first that nothing in your dashboards actually depends on those bundled datasources before removing them, and rescanning afterward to see if any other bundled plugins are still flagged.