Read the docs
TI-2018-11213 Aliases CVE-2018-15727GHSA-rgjg-66cx-5x9m

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass…

Priority HIGH 77CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Why it matters now

EPSS 0.63124 99th percentileScored 2026-11-07
Fix Partial github.com/grafana/grafana (Go): 4.6.4, 5.2.3Red Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/grafana/grafana (Go)before 4.6.44.6.4Patch availableGHSA-rgjg-66cx-5x9m
—github.com/grafana/grafana (Go)5.0.0 to before 5.2.35.2.3Patch availableGHSA-rgjg-66cx-5x9m
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/grafana/grafana (Go) Vendor— Affected before 4.6.4 Fixed in 4.6.4 Patch available GHSA-rgjg-66cx-5x9m
  • github.com/grafana/grafana (Go) Vendor— Affected 5.0.0 to before 5.2.3 Fixed in 5.2.3 Patch available GHSA-rgjg-66cx-5x9m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*2.0.0 – 2.1.2; 3.0.0 – 3.1.1; 4.0.0 to before 4.6.4; 5.0.0 to before 5.2.3VulnerableGrafana
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.1.2; 3.0.0 – 3.1.1; 4.0.0 to before 4.6.4; 5.0.0 to before 5.2.3 Vulnerable ·Grafana
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-rgjg-66cx-5x9m github.com/grafana/grafana (Go) Fixed in 4.6.4 Advisory →
  • Fix · GHSA-rgjg-66cx-5x9m github.com/grafana/grafana (Go) Fixed in 5.2.3 Advisory →

Red Hat 2 advisories

  • RHSA-2019:0019 Released 2019-01-03 · Red Hat rating Moderate
    grafana security and bug fix update
    • Red Hat Ceph Storage 3.2 Tools grafana-5.2.4-1.el7cp
  • RHSA-2018:3829 Released 2018-12-17 · Red Hat rating Moderate
    RHGS WA security and bug fix update
    • Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 tendrl-gluster-integration-1.6.3-13.el7rhgs, tendrl-node-agent-1.6.3-11.el7rhgs
    • Red Hat Gluster 3.4 Web Administration on RHEL-7 grafana-4.6.4-1.el7rhgs, tendrl-ansible-1.6.3-10.el7rhgs, tendrl-api-1.6.3-8.el7rhgs +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 8 (Liberty) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3.2 ToolsFixed RHSA-2019:0019
Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7Fixed RHSA-2018:3829
Red Hat Gluster 3.4 Web Administration on RHEL-7Fixed RHSA-2018:3829

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15727
  2. 2026-10-03 Alias added: GHSA-rgjg-66cx-5x9m

References

Patch 1

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences