EUVD-2026-16596
GHSA-3q27-7qjq-p9c5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Anonymous public-dashboard viewer needs no auth or interaction (PR:N/UI:N/AV:N); exposed data-source passwords are high-confidentiality credentials (C:H) with no integrity or availability impact.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
11DescriptionNVD
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
AnalysisAI
Sensitive credential disclosure in Grafana (versions in the 9.3.0-11.6.x, 12.0.x-12.4.x lines) exposes the stored passwords of all direct (non-proxied) data sources whenever the public dashboards feature is enabled, even for data sources never referenced by any dashboard. Reported by Grafana with a vendor patch available, the flaw lets unauthenticated viewers of a public dashboard harvest backend data-source credentials (CVSS 7.5, C:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.01%) with CISA SSVC rating exploitation as none.
Technical ContextAI
Grafana is a widely used open-source observability and dashboarding platform that connects to backend data sources (databases, TSDBs, cloud APIs). It supports two access modes: 'proxied', where Grafana's server brokers queries and credentials stay server-side, and 'direct' (browser) mode, where connection details are sent to the client. The public dashboards feature renders dashboards to unauthenticated users. The root cause maps to CWE-312 (Cleartext Storage / Exposure of Sensitive Information): when public dashboards are active alongside direct data sources, Grafana over-shares the full direct data-source configuration-including stored passwords-to the public, anonymous context rather than scoping it to only what a dashboard needs. The affected component is identified by CPE cpe:2.3:a:grafana:grafana, and the vendor explicitly notes proxied data sources are unaffected.
RemediationAI
Apply the vendor-released patch by upgrading Grafana to the first fixed release in your branch: 11.6.14 (for 9.3.0-11.6.x), 12.1.10, 12.2.8, 12.3.6, or 12.4.2 or later, per the Grafana advisory at https://grafana.com/security/security-advisories/cve-2026-27877. Red Hat-packaged deployments should apply the corresponding errata (e.g., RHSA-2026:10223/10226/11416/11417/19134/19352 via https://access.redhat.com/security/cve/CVE-2026-27877). If immediate patching is not possible, the most effective compensating control is to disable the public dashboards feature (removing the anonymous exposure path entirely, at the cost of losing public sharing), or convert affected direct data sources to proxied mode as the vendor explicitly recommends (keeps credentials server-side, but requires that Grafana's backend can reach those sources and may change query behavior for browser-mode-dependent plugins). As an interim measure, rotate any data-source passwords that may have been exposed while the vulnerable configuration was live.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today