EUVD-2026-102073
GHSA-c6mh-c9x8-gf7q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Viewer
-
DeliverySend write request via data source proxy
-
ExploitReach Loki rules API unauthorized
-
ExecutionCreate/modify/delete alerting rules
-
ImpactDisrupt monitoring for all data source users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Viewer-role account on the Grafana instance and at least one configured Loki data source reachable through Grafana's data source proxy; the attacker then issues POST/PUT/DELETE requests to the Loki rules API endpoint (/loki/api/v1/rules). No higher Grafana privileges and no access to Loki itself are needed, and Loki does not require patching. Limiting factors: the instance must have a Loki data source configured, and the attacker must already possess valid Viewer credentials, so purely anonymous/unauthenticated exploitation is not possible. Both Grafana OSS and Grafana Enterprise in default configuration are affected once a Loki data source exists. |
| Impact | This is a genuine but moderate-priority authorization flaw (CWE-284) rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only a low-privilege (Viewer) authenticated account and no user interaction, which is why the base score lands at 7.1. The impact profile is skewed: confidentiality is untouched (C:N), integrity is high (I:H) because a Viewer can create, modify or delete Loki alerting rules, and availability is low (A:L) because deleting or corrupting alerting rules can blind or disrupt monitoring. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk driver is that the change persists in Loki and affects every consumer of that data source, turning a single low-privilege account into a cross-tenant integrity problem. The main mitigating factor is the authentication requirement: an attacker must already hold a valid Viewer account on the Grafana instance and the instance must have a Loki data source configured. |
| Exploit ScenarioDerived | An attacker with only a Viewer account on a Grafana instance that has a Loki data source configured sends a crafted POST, PUT or DELETE request through Grafana's data source proxy to the Loki rules API (/loki/api/v1/rules). Because the proxy fails to enforce RBAC on write requests, the request succeeds and the attacker creates, alters or deletes alerting rules that then apply to every user of that Loki data source. No public exploit code was provided in the input, but the attack is trivial to script given a valid Viewer session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
RemediationAI
Apply the Grafana fix referenced in the vendor advisory at https://grafana.com/security/security-advisories/cve-2026-9703 (patch available per vendor advisory; consult that page for the exact patched version, as no specific fix version is given in the provided data). If immediate upgrade is not possible, reduce exposure by removing or temporarily disabling Loki data sources that do not need to be reachable through Grafana, which eliminates the attack path but also disables Loki-backed dashboards and alerting for all Grafana users. Alternatively, enforce method-level restrictions upstream of Grafana or on the network path to Loki so that Viewer-facing proxy traffic cannot reach /loki/api/v1/rules with POST, PUT, or DELETE, though this requires careful rule authoring to avoid breaking legitimate editor workflows. As a compensating detective control, audit existing Loki alerting rules for unauthorized additions or deletions, since the flaw allows changes that persist for every user of the data source and may have been made silently.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an improper access control weakness (CWE-284) in Grafana's data source proxy, the component that brokers queries and requests from Grafana to configured backends such as Loki. The proxy correctly permitted read traffic for Viewers but did not restrict HTTP write methods (POST, PUT, DELETE) to the Loki rules API endpoint /loki/api/v1/rules, so a Viewer-role session could reach an administrative write path that should have required Editor or Admin privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L). Because alerting rules are persisted by Loki and not by Grafana, unauthorized rule creation or deletion becomes a cross-user, data-source-wide integrity issue rather than a per-account change. Affected CPE entries cover both grafana_oss and grafana_enterprise, confirming the proxy code path is shared by the community and commercial distributions; Loki itself is only the downstream target and contains no vulnerable code.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-reachable proxy abuse by an authenticated Viewer (PR:L, AC:L); high integrity impact from writable alerting rules, low availability impact from rule deletion, no confidentiality exposure.
Primary rating from Vendor (GRAFANA).
CVSS VectorVendor: GRAFANA
DescriptionCVE.org
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.
Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
Executive ViewAI
Grafana OSS and Grafana Enterprise deployments that use Loki data sources are exposed to a privilege escalation flaw (CVE-2026-9703) allowing any user with the Viewer role to silently create, modify, or delete Loki alerting rules that affect every user of that data source. This undermines the integrity of monitoring and alerting, potentially enabling insiders or compromised low-privilege accounts to suppress critical alerts or trigger false ones without detection. No public exploit identified at time of analysis, but no vendor patch is available, so leadership should prioritize interim mitigations to protect operational visibility and incident response.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting Grafana Viewer role assignments, auditing and monitoring Loki rules API write operations, disabling Loki data sources for non-admin users, and deploying a read-only proxy for the Loki rules endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Exploit-DB