docker.io/grafana/grafana:13.0.3

Base OS: alpine 3.24.137 vulnerabilities fixed

Patched Image

ghcr.io/verity-org/grafana/grafana:13.0.3

Supply Chain

SignedSLSA L3SBOMRekor

Verify this artifact

Cosign signature

cosign verify \
  --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/verity-org/grafana/grafana:13.0.3

Build provenance

gh attestation verify \
  oci://ghcr.io/verity-org/grafana/grafana:13.0.3 \
  --owner verity-org

Before patching

Found 54 vulnerabilities in the original image. 37 fixed by Copa. 17 remaining after patching.

29 HIGH15 MEDIUM3 LOW7 UNKNOWN

Fix available — pending patch

These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.

CVE-2026-21728HIGH
Package
github.com/grafana/tempo
Installed
v1.5.1-0.20251027222923-cbe5f845dc7b
Fixed
2.8.4, 2.9.2, 2.10.2
CVE-2026-28377HIGH
Package
github.com/grafana/tempo
Installed
v1.5.1-0.20251027222923-cbe5f845dc7b
Fixed
2.10.3
CVE-2026-42151HIGH
Package
github.com/prometheus/prometheus
Installed
v0.305.3
Fixed
0.311.3
CVE-2026-27145HIGH
Package
stdlib
Installed
v1.26.3
Fixed
1.25.11, 1.26.4
CVE-2026-42504HIGH
Package
stdlib
Installed
v1.26.3
Fixed
1.25.11, 1.26.4
CVE-2026-48096MEDIUM
Package
github.com/openfga/openfga
Installed
v1.14.2
Fixed
1.16.0
CVE-2026-55689MEDIUM
Package
github.com/openfga/openfga
Installed
v1.14.2
Fixed
1.18.0
CVE-2026-40179MEDIUM
Package
github.com/prometheus/prometheus
Installed
v0.305.3
Fixed
0.311.2-0.20260410083055-07c6232d159b
CVE-2026-44903MEDIUM
Package
github.com/prometheus/prometheus
Installed
v0.305.3
Fixed
0.311.3
CVE-2026-42507MEDIUM
Package
stdlib
Installed
v1.26.3
Fixed
1.25.11, 1.26.4
CVE-2026-55170LOW
Package
github.com/openfga/openfga
Installed
v1.14.2
Fixed
1.18.0
CVE-2026-39822UNKNOWN
Package
stdlib
Installed
v1.26.4
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2
CVE-2026-42505UNKNOWN
Package
stdlib
Installed
v1.26.4
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2
CVE-2026-39822UNKNOWN
Package
stdlib
Installed
v1.26.3
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2
CVE-2026-42505UNKNOWN
Package
stdlib
Installed
v1.26.3
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2

ID	Package	Installed	Fixed	Severity
CVE-2026-21728	github.com/grafana/tempo	v1.5.1-0.20251027222923-cbe5f845dc7b	2.8.4, 2.9.2, 2.10.2	HIGH
CVE-2026-28377	github.com/grafana/tempo	v1.5.1-0.20251027222923-cbe5f845dc7b	2.10.3	HIGH
CVE-2026-42151	github.com/prometheus/prometheus	v0.305.3	0.311.3	HIGH
CVE-2026-27145	stdlib	v1.26.3	1.25.11, 1.26.4	HIGH
CVE-2026-42504	stdlib	v1.26.3	1.25.11, 1.26.4	HIGH
CVE-2026-48096	github.com/openfga/openfga	v1.14.2	1.16.0	MEDIUM
CVE-2026-55689	github.com/openfga/openfga	v1.14.2	1.18.0	MEDIUM
CVE-2026-40179	github.com/prometheus/prometheus	v0.305.3	0.311.2-0.20260410083055-07c6232d159b	MEDIUM
CVE-2026-44903	github.com/prometheus/prometheus	v0.305.3	0.311.3	MEDIUM
CVE-2026-42507	stdlib	v1.26.3	1.25.11, 1.26.4	MEDIUM
CVE-2026-55170	github.com/openfga/openfga	v1.14.2	1.18.0	LOW
CVE-2026-39822	stdlib	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	UNKNOWN
CVE-2026-42505	stdlib	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	UNKNOWN
CVE-2026-39822	stdlib	v1.26.3	1.25.12, 1.26.5, 1.27.0-rc.2	UNKNOWN
CVE-2026-42505	stdlib	v1.26.3	1.25.12, 1.26.5, 1.27.0-rc.2	UNKNOWN

Awaiting upstream fix

No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.

GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.52.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.52.0
Fixed

ID	Package	Installed	Fixed	Severity
GO-2026-5932	golang.org/x/crypto	v0.52.0		UNKNOWN
GO-2026-5932	golang.org/x/crypto	v0.52.0		UNKNOWN

Original image reference

docker.io/grafana/grafana:13.0.3