EUVD-2026-16596
GHSA-3q27-7qjq-p9c5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public dashboard URL
-
DeliveryOpen dashboard as anonymous user
-
ExploitInspect data sent to browser
-
ExecutionExtract direct data-source passwords
-
ImpactReuse credentials against backend databases
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encrypted storage of sensitive data
|
| Exploitation Conditions | Exploitation requires that the Grafana instance has the public dashboards feature enabled AND has at least one data source configured in 'direct' (browser) access mode-both are non-default conditions an operator must turn on. When that combination exists, no authentication or user interaction is needed: an anonymous network user viewing the public dashboard can retrieve the passwords of every direct data source, including ones not used by any dashboard. What limits exploitation: deployments that use only proxied data sources are not vulnerable, and instances that do not expose public dashboards have no anonymous attack path, so the realistic exposed population is much smaller than the raw 7.5 CVSS implies. |
| Impact | Signals are mixed and point to a real-but-conditional issue rather than an urgent mass-exploitation event. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H) yields 7.5 and reflects that an unauthenticated network attacker can read the passwords once the vulnerable configuration is live-a meaningful confidentiality impact since data-source credentials can pivot into backend databases. However, EPSS is only 0.01% (1st percentile) and CISA's SSVC framework rates Exploitation: none, Automatable: no, Technical Impact: partial, indicating no observed exploitation and limited automatability. The key caveat: exploitation is gated on a non-default combination (public dashboards enabled AND direct data sources in use), which the CVSS PR:N/AC:L scoring does not capture-the practical attack surface is narrower than 7.5 suggests. Many deployments use proxied data sources and/or do not expose public dashboards, so this is a prioritize-if-configured rather than patch-everything-immediately issue. No public exploit identified at time of analysis. |
| Exploit ScenarioDerived | A Grafana instance has public dashboards enabled and several direct-mode data sources configured. An anonymous attacker simply opens a public dashboard URL and inspects the data returned to the browser, recovering the cleartext passwords of all direct data sources-including ones not shown on any dashboard-then reuses those credentials to query the backend databases directly. No public exploit is identified at time of analysis, and the attack requires no authentication or user interaction, consistent with AV:N/AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Sensitive credential disclosure in Grafana (versions in the 9.3.0-11.6.x, 12.0.x-12.4.x lines) exposes the stored passwords of all direct (non-proxied) data sources whenever the public dashboards feature is enabled, even for data sources never referenced by any dashboard. Reported by Grafana with a vendor patch available, the flaw lets unauthenticated viewers of a public dashboard harvest backend data-source credentials (CVSS 7.5, C:H). There is no public exploit identified at time of analysis, and EPSS is very low (0.01%) with CISA SSVC rating exploitation as none.
Earlier versions of this analysis (4)
Sensitive credential disclosure in Grafana (versions from 9.3.0 through the 12.4.x branch) exposes the stored passwords of all configured 'direct' (browser-mode) data sources whenever the public dashboards feature is enabled, even for data sources that are never referenced by any published dashboard. The flaw is reported by Grafana itself with an exact patch set, carries a CVSS of 7.5 (confidentiality-only), and has no public exploit identified at time of analysis; EPSS is very low (0.01%) and it is not in CISA KEV.
Sensitive credential disclosure in Grafana (versions in the 9.3.x through 12.4.x lines) allows remote unauthenticated users to retrieve the stored passwords of all direct (browser-mode) data sources whenever public dashboards are enabled, even for data sources never referenced by any published dashboard. The flaw, reported by Grafana itself and tracked as EUVD-2026-16596, is a cleartext/improper-protection issue (CWE-312) carrying CVSS 7.5 with no integrity or availability impact. There is no public exploit identified at time of analysis, the EPSS probability is negligible (0.01%), and CISA SSVC rates exploitation as none and non-automatable.
Sensitive credential disclosure in Grafana affects deployments that combine the public dashboards feature with direct (browser-side) data sources, where the configured passwords of ALL direct data sources are exposed to anonymous viewers even if those data sources are never referenced by the dashboard. Rated CVSS 7.5 (confidentiality-only impact), it carries a very low EPSS of 0.01% and an SSVC exploitation status of 'none'; no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available across all maintained release trains.
Grafana publicly exposes direct data-source credentials in public dashboards, allowing authenticated users to retrieve plaintext passwords for all configured direct data-sources regardless of whether those sources are actively referenced in the dashboard itself. Grafana versions affected by CVE-2026-27877 leak sensitive authentication material through an information disclosure vulnerability with a CVSS score of 6.5 (Medium severity). Authenticated attackers with access to public dashboards can extract database passwords, API keys, and other credentials without requiring additional privileges or user interaction. Proxied data-sources are not affected by this vulnerability.
RemediationAI
Apply the vendor-released patch by upgrading Grafana to the first fixed release in your branch: 11.6.14 (for 9.3.0-11.6.x), 12.1.10, 12.2.8, 12.3.6, or 12.4.2 or later, per the Grafana advisory at https://grafana.com/security/security-advisories/cve-2026-27877. Red Hat-packaged deployments should apply the corresponding errata (e.g., RHSA-2026:10223/10226/11416/11417/19134/19352 via https://access.redhat.com/security/cve/CVE-2026-27877). If immediate patching is not possible, the most effective compensating control is to disable the public dashboards feature (removing the anonymous exposure path entirely, at the cost of losing public sharing), or convert affected direct data sources to proxied mode as the vendor explicitly recommends (keeps credentials server-side, but requires that Grafana's backend can reach those sources and may change query behavior for browser-mode-dependent plugins). As an interim measure, rotate any data-source passwords that may have been exposed while the vulnerable configuration was live.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grafana is a widely used open-source observability and dashboarding platform that connects to backend data sources (databases, TSDBs, cloud APIs). It supports two access modes: 'proxied', where Grafana's server brokers queries and credentials stay server-side, and 'direct' (browser) mode, where connection details are sent to the client. The public dashboards feature renders dashboards to unauthenticated users. The root cause maps to CWE-312 (Cleartext Storage / Exposure of Sensitive Information): when public dashboards are active alongside direct data sources, Grafana over-shares the full direct data-source configuration-including stored passwords-to the public, anonymous context rather than scoping it to only what a dashboard needs. The affected component is identified by CPE cpe:2.3:a:grafana:grafana, and the vendor explicitly notes proxied data sources are unaffected.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Anonymous public-dashboard viewer needs no auth or interaction (PR:N/UI:N/AV:N); exposed data-source passwords are high-confidentiality credentials (C:H) with no integrity or availability impact.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Executive ViewAI
Grafana versions 9.3-12.4.x expose all stored data source credentials to unauthenticated users when the public dashboards feature is enabled, creating uncontrolled access to backend database passwords regardless of whether those sources appear in any dashboard. Organizations running vulnerable instances face direct risk to production database credentials and backend infrastructure authentication material.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
Exploit-DB