The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0439 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8986:
    The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`.

    If credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials.

    CVE-2022-41723:
    A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests.

    CVE-2023-39325:
    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function.

    CVE-2023-44487:
    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023.

    CVE-2023-45288:
    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection.

    CVE-2025-22870:
    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0339 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8986:
    A vulnerability was found in Grafana's data source proxy API, which allows authorization checks to be     bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain     unauthorized read access to GET endpoints in Alert manager and Prometheus data sources. The issue     primarily affects data sources that implement route-specific permissions, including Alert manager and     certain Prometheus-based data sources.

    CVE-2024-8118:
    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    CVE-2024-11741:
    The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`.

    If credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials.

    CVE-2025-22872:
    In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with     permission to write external alert instances to also write alert rules.

    CVE-2025-3454:
    Grafana is an open-source platform for monitoring and observability.
    The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with     Viewer permission.
    Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If     credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials. (CVE-2024-8986)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
276365	TencentOS Server 4: grafana-pcp (TSSA-2025:0439)	Nessus	Tencent Local Security Checks	critical
276350	TencentOS Server 4: grafana (TSSA-2025:0339)	Nessus	Tencent Local Security Checks	critical
231875	Linux Distros Unpatched Vulnerability : CVE-2024-8986	Nessus	Misc.	high

Detections

Analytics

CVE-2024-8986

critical

Tenable Plugins

critical

critical

high