Exposure of Sensitive Information in Grafana
Priority LOW 22CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01176 67th percentileScored 2026-11-07
Fix Partial grafana (grafana): 7.5.15, 8.3.5github.com/grafana/grafana (Go): 7.5.15, 8.3.5Red Hat: 2 advisoriesRed Hat: 2 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | grafana | 5.0.0-beta1 to before 7.5.15; 8.0.0 to before 8.3.5 | 7.5.15, 8.3.5 | Patch available | CNA |
| — | github.com/grafana/grafana (Go) | 5.0.0-beta1 to before 7.5.15 | 7.5.15 | Patch available | GHSA-63g3-9jq3-mccv |
| — | github.com/grafana/grafana (Go) | 8.0.0 to before 8.3.5 | 8.3.5 | Patch available | GHSA-63g3-9jq3-mccv |
- grafana VendorGrafana Affected 5.0.0-beta1 to before 7.5.15; 8.0.0 to before 8.3.5 Fixed in 7.5.15, 8.3.5 Patch available CNA
- github.com/grafana/grafana (Go) Vendor— Affected 5.0.0-beta1 to before 7.5.15 Fixed in 7.5.15 Patch available GHSA-63g3-9jq3-mccv
- github.com/grafana/grafana (Go) Vendor— Affected 8.0.0 to before 8.3.5 Fixed in 8.3.5 Patch available GHSA-63g3-9jq3-mccv
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | 5.0.0 to before 7.5.15; 8.0.0 to before 8.3.5 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:5.0.0:beta1:*:*:*:*:*:* | 5.0.0 beta1 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:5.0.0:beta2:*:*:*:*:*:* | 5.0.0 beta2 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:5.0.0:beta3:*:*:*:*:*:* | 5.0.0 beta3 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:5.0.0:beta4:*:*:*:*:*:* | 5.0.0 beta4 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:5.0.0:beta5:*:*:*:*:*:* | 5.0.0 beta5 | Vulnerable | Grafana |
| cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 5.0.0 to before 7.5.15; 8.0.0 to before 8.3.5 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:5.0.0:beta2:*:*:*:*:*:* Versions 5.0.0 beta2 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:5.0.0:beta3:*:*:*:*:*:* Versions 5.0.0 beta3 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:5.0.0:beta4:*:*:*:*:*:* Versions 5.0.0 beta4 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:5.0.0:beta5:*:*:*:*:*:* Versions 5.0.0 beta5 Vulnerable ·Grafana
- cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA grafana (grafana) Fixed in 7.5.15, 8.3.5
- Fix · GHSA-63g3-9jq3-mccv github.com/grafana/grafana (Go) Fixed in 7.5.15 Advisory →
- Fix · GHSA-63g3-9jq3-mccv github.com/grafana/grafana (Go) Fixed in 8.3.5 Advisory →
Red Hat 2 advisories
- RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Importantgrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
- RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7519 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8057 |
Not affected: 2 products
- Red Hat 3scale API Management Platform 2
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21713
- 2026-10-03 Alias added: GHSA-63g3-9jq3-mccv
References
Advisory 7
- https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
- https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv
- https://security.netapp.com/advisory/ntap-20220303-0005/
- FEDORA-2022-83405f9d5b
- FEDORA-2022-9dd03cab55
- FEDORA-2022-c5383675d9
- https://nvd.nist.gov/vuln/detail/CVE-2022-21713
Other 6
- https://github.com/grafana/grafana
- https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
- https://security.netapp.com/advisory/ntap-20220303-0005
More Grafana vulnerabilities
- TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
Sources
- CVE-2022-21713 · CVE Program
- CVE-2022-21713 · NVD
- FIRST EPSS
- GHSA-63g3-9jq3-mccv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-21713 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences