Grafana CVE-2026-15815

Requires a Grafana operator to install a plugin - via the plugin catalog, the grafana-cli tool, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration - from an attacker-influenced archive; this operator action is the UI:R gate. Critically, plugin signature verification does NOT limit exploitation because archives are extracted before the signature is checked, so requiring signed plugins is not a mitigating control here. Applies to both Grafana OSS and Grafana Enterprise (identical extraction code). Limiting factors: an operator install action is mandatory (no unattended remote trigger against a running server), and impact is bounded to the privileges of the Grafana server process.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk paper cut. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity path to full remote code execution running with the privileges of the Grafana server process. The most important corroborating detail from the description is that plugin archives are extracted BEFORE signature verification - so the standard defense (only install signed plugins) does not stop the write, materially raising real-world risk versus a typical 'only install trusted plugins' caveat. The one strong mitigating signal is UI:R: exploitation requires an operator action (installing a plugin via the plugin catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall config), so this is not a fully drive-by remote exploit against an idle server. No EPSS score, CISA KEV entry, or public POC was provided in the input, so per available data this is 'no public exploit identified at time of analysis' - the severity rests on the technical impact and the signature-bypass property rather than on confirmed active exploitation. The PR:N with UI:R combination is internally consistent: the attacker needs no Grafana privileges, but a privileged operator must be socially engineered or misled into installing the malicious archive.

An attacker publishes a plugin archive that looks legitimate (or convinces an operator to install an arbitrary archive) containing chained relative symlink entries. When a Grafana operator installs it via the catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall config, extraction follows the symlinks out of the plugin directory and drops an executable backend binary elsewhere on disk, which Grafana then runs as the server process - yielding RCE. Because extraction precedes signature verification, even a validly signed-looking package flow does not prevent the write; no public exploit code was identified in the provided data.