Read the docs
TI-2022-13151 Aliases CVE-2022-31107GHSA-mx47-6497-3fv2

Grafana account takeover via OAuth vulnerability

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02874 86th percentileScored 2026-11-07
Fix Partial grafana (grafana): 8.3.10, 8.4.10, 8.5.9 +1github.com/grafana/grafana (Go): 8.3.10, 8.4.10, 8.5.9 +1Red Hat: 6 advisoriesRed Hat: 6 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Grafanagrafana5.3 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.38.3.10, 8.4.10, 8.5.9, 9.0.3Patch availableCNA
—github.com/grafana/grafana (Go)5.3.0-beta1 to before 8.3.108.3.10Patch availableGHSA-mx47-6497-3fv2
—github.com/grafana/grafana (Go)8.4.0 to before 8.4.108.4.10Patch availableGHSA-mx47-6497-3fv2
—github.com/grafana/grafana (Go)8.5.0 to before 8.5.98.5.9Patch availableGHSA-mx47-6497-3fv2
—github.com/grafana/grafana (Go)9.0.0 to before 9.0.39.0.3Patch availableGHSA-mx47-6497-3fv2
  • grafana VendorGrafana Affected 5.3 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.3 Fixed in 8.3.10, 8.4.10, 8.5.9, 9.0.3 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 5.3.0-beta1 to before 8.3.10 Fixed in 8.3.10 Patch available GHSA-mx47-6497-3fv2
  • github.com/grafana/grafana (Go) Vendor— Affected 8.4.0 to before 8.4.10 Fixed in 8.4.10 Patch available GHSA-mx47-6497-3fv2
  • github.com/grafana/grafana (Go) Vendor— Affected 8.5.0 to before 8.5.9 Fixed in 8.5.9 Patch available GHSA-mx47-6497-3fv2
  • github.com/grafana/grafana (Go) Vendor— Affected 9.0.0 to before 9.0.3 Fixed in 9.0.3 Patch available GHSA-mx47-6497-3fv2

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*5.3.0 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.3VulnerableGrafana
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 5.3.0 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.3 Vulnerable ·Grafana
  • cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA grafana (grafana) Fixed in 8.3.10, 8.4.10, 8.5.9, 9.0.3
  • Fix · GHSA-mx47-6497-3fv2 github.com/grafana/grafana (Go) Fixed in 8.3.10 Advisory →
  • Fix · GHSA-mx47-6497-3fv2 github.com/grafana/grafana (Go) Fixed in 8.4.10 Advisory →
  • Fix · GHSA-mx47-6497-3fv2 github.com/grafana/grafana (Go) Fixed in 8.5.9 Advisory →
  • Fix · GHSA-mx47-6497-3fv2 github.com/grafana/grafana (Go) Fixed in 9.0.3 Advisory →

Red Hat 6 advisories

  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2022:5717 Released 2022-07-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.11-3.el8_6
  • RHSA-2022:5718 Released 2022-07-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) grafana-7.3.6-5.el8_4
Show 3 more Red Hat advisories
  • RHSA-2022:5719 Released 2022-07-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) grafana-6.3.6-5.el8_2, grafana-azure-monitor-6.3.6-5.el8_2, grafana-cloudwatch-6.3.6-5.el8_2 +10
  • RHSA-2022:5716 Released 2022-07-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.11-5.el9_0
  • RHSA-2022:5720 Released 2022-07-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) grafana-6.2.2-9.el8_1, grafana-azure-monitor-6.2.2-9.el8_1, grafana-cloudwatch-6.2.2-9.el8_1 +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:5717
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:5716
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:5720
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:5719
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:5718
Not affected: 4 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31107
  2. 2026-10-03 Alias added: GHSA-mx47-6497-3fv2

References

Advisory 6

Other 5

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences