EUVD-2026-16596
GHSA-3q27-7qjq-p9c5
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Analysis
Grafana publicly exposes direct data-source credentials in public dashboards, allowing authenticated users to retrieve plaintext passwords for all configured direct data-sources regardless of whether those sources are actively referenced in the dashboard itself. Grafana versions affected by CVE-2026-27877 leak sensitive authentication material through an information disclosure vulnerability with a CVSS score of 6.5 (Medium severity). …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today