Snapshot authentication bypass in grafana
Priority CRITICAL 100Exploited in the wildCWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 9 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Why it matters now
Exploitation Active In CISA KEV since 2022-08-25CISA due date 2022-09-15
EPSS 0.99933 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial grafana (grafana): 8.1.6, 7.5.11github.com/grafana/grafana (Go): 7.5.11, 8.1.6Red Hat: 9 advisoriesRed Hat: 9 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | grafana | 8.0.0 to before 8.1.6; before 7.5.11 | 8.1.6, 7.5.11 | Patch available | CNA |
| — | github.com/grafana/grafana (Go) | before 7.5.11 | 7.5.11 | Patch available | GHSA-69j6-29vr-p3j9 |
| — | github.com/grafana/grafana (Go) | 8.0.0 to before 8.1.6 | 8.1.6 | Patch available | GHSA-69j6-29vr-p3j9 |
- grafana VendorGrafana Affected 8.0.0 to before 8.1.6; before 7.5.11 Fixed in 8.1.6, 7.5.11 Patch available CNA
- github.com/grafana/grafana (Go) Vendor— Affected before 7.5.11 Fixed in 7.5.11 Patch available GHSA-69j6-29vr-p3j9
- github.com/grafana/grafana (Go) Vendor— Affected 8.0.0 to before 8.1.6 Fixed in 8.1.6 Patch available GHSA-69j6-29vr-p3j9
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | before 7.5.11; 8.0.0 to before 8.1.6 | Vulnerable | Grafana |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions before 7.5.11; 8.0.0 to before 8.1.6 Vulnerable ·Grafana
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA grafana (grafana) Fixed in 8.1.6, 7.5.11
- Fix · GHSA-69j6-29vr-p3j9 github.com/grafana/grafana (Go) Fixed in 7.5.11 Advisory →
- Fix · GHSA-69j6-29vr-p3j9 github.com/grafana/grafana (Go) Fixed in 8.1.6 Advisory →
Red Hat 9 advisories
- RHSA-2022:6308 Released 2022-09-14 · Red Hat rating ImportantOpenShift Container Platform 4.8.49 security update
- Red Hat OpenShift Container Platform 4.8 openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2022:6322 Released 2022-09-13 · Red Hat rating ModerateOpenShift Container Platform 4.7.59 bug fix and security update
- Red Hat OpenShift Container Platform 4.7 openshift4/ose-grafana
- RHSA-2022:6317 Released 2022-09-12 · Red Hat rating ImportantOpenShift Container Platform 4.9.48 bug fix and security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-grafana
Show 6 more Red Hat advisories
- RHSA-2022:6262 Released 2022-09-09 · Red Hat rating ImportantOpenShift Container Platform 4.6.61 bug fix and security update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8-operator, openshift4/ose-aws-machine-controllers +47
- RHSA-2022:6252 Released 2022-09-07 · Red Hat rating ModerateOpenShift Container Platform 3.11.784 security update
- Red Hat OpenShift Container Platform 3.11 openshift3/grafana
- RHSA-2022:0056 Released 2022-03-10 · Red Hat rating ModerateOpenShift Container Platform 4.10.3 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2021:3771 Released 2021-10-12 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.3.6-3.el8_4
- RHSA-2021:3770 Released 2021-10-12 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) grafana-6.3.6-3.el8_2, grafana-azure-monitor-6.3.6-3.el8_2, grafana-cloudwatch-6.3.6-3.el8_2 +10
- RHSA-2021:3769 Released 2021-10-12 · Red Hat rating Importantgrafana security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) grafana-6.2.2-7.el8_1, grafana-azure-monitor-6.2.2-7.el8_1, grafana-cloudwatch-6.2.2-7.el8_1 +10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3771 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:3769 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:3770 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2022:6252 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0056 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2022:6262 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2022:6322 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2022:6308 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2022:6317 |
Not affected: 8 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Platform 4.9
Timeline
- 2022-08-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-39226
- 2026-10-03 Alias added: GHSA-69j6-29vr-p3j9
References
Advisory 5
Other 11
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/
- https://github.com/grafana/grafana
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG
- https://security.netapp.com/advisory/ntap-20211029-0008
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226
More Grafana vulnerabilities
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
- TI-2022-13141 Stored XSS in Grafana's Unified Alerting CVSS 3.1HIGH 8.7
Sources
- CVE-2021-39226 · CVE Program
- CVE-2021-39226 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-69j6-29vr-p3j9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-39226 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences