Read the docs
TI-2023-02931 Aliases CVE-2023-3128GHSA-mpv3-g8m3-3fjc

Authentication bypass by spoofing in Grafana

Priority HIGH 82CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-290.

Summary

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03995 90th percentileScored 2026-11-09
Fix Partial Grafana (Grafana): 9.5.4, 9.4.13, 9.3.16 +2Grafana Enterprise (Grafana): 9.5.4, 9.4.13, 9.3.16 +2+1 more productRed Hat: 4 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GrafanaGrafana9.5.0 to before 9.5.4; 9.4.0 to before 9.4.13; 9.3.0 to before 9.3.16; 9.2.0 to before 9.2.20; 6.7.0 to before 8.5.279.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27Patch availableCNA
GrafanaGrafana Enterprise9.5.0 to before 9.5.4; 9.4.0 to before 9.4.13; 9.3.0 to before 9.3.16; 9.2.0 to before 9.2.20; 6.7.0 to before 8.5.279.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27Patch availableCNA
—github.com/grafana/grafana (Go)9.4.0 to before 9.4.139.4.13Patch availableGHSA-mpv3-g8m3-3fjc
—github.com/grafana/grafana (Go)9.3.0 to before 9.3.169.3.16Patch availableGHSA-mpv3-g8m3-3fjc
—github.com/grafana/grafana (Go)9.0.0 to before 9.2.209.2.20Patch availableGHSA-mpv3-g8m3-3fjc
—github.com/grafana/grafana (Go)before 8.5.278.5.27Patch availableGHSA-mpv3-g8m3-3fjc
  • Grafana VendorGrafana Affected 9.5.0 to before 9.5.4; 9.4.0 to before 9.4.13; 9.3.0 to before 9.3.16; 9.2.0 to before 9.2.20; 6.7.0 to before 8.5.27 Fixed in 9.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27 Patch available CNA
  • Grafana Enterprise VendorGrafana Affected 9.5.0 to before 9.5.4; 9.4.0 to before 9.4.13; 9.3.0 to before 9.3.16; 9.2.0 to before 9.2.20; 6.7.0 to before 8.5.27 Fixed in 9.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 9.4.0 to before 9.4.13 Fixed in 9.4.13 Patch available GHSA-mpv3-g8m3-3fjc
  • github.com/grafana/grafana (Go) Vendor— Affected 9.3.0 to before 9.3.16 Fixed in 9.3.16 Patch available GHSA-mpv3-g8m3-3fjc
  • github.com/grafana/grafana (Go) Vendor— Affected 9.0.0 to before 9.2.20 Fixed in 9.2.20 Patch available GHSA-mpv3-g8m3-3fjc
  • github.com/grafana/grafana (Go) Vendor— Affected before 8.5.27 Fixed in 8.5.27 Patch available GHSA-mpv3-g8m3-3fjc

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*6.7.0 to before 8.5.27VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*6.7.0 to before 8.5.27VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*9.2.0 to before 9.2.20VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*9.2.0 to before 9.2.20VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*9.3.0 to before 9.3.16VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*9.3.0 to before 9.3.16VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*9.4.0 to before 9.4.13VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*9.4.0 to before 9.4.13VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*9.5.0 to before 9.5.4VulnerableGrafana
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*9.5.0 to before 9.5.4VulnerableGrafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:* Versions 6.7.0 to before 8.5.27 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 6.7.0 to before 8.5.27 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:* Versions 9.2.0 to before 9.2.20 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 9.2.0 to before 9.2.20 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:* Versions 9.3.0 to before 9.3.16 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 9.3.0 to before 9.3.16 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:* Versions 9.4.0 to before 9.4.13 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 9.4.0 to before 9.4.13 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:* Versions 9.5.0 to before 9.5.4 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 9.5.0 to before 9.5.4 Vulnerable ·Grafana

Remediation

  • Fix · CNA Grafana (Grafana) Fixed in 9.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27
  • Fix · CNA Grafana Enterprise (Grafana) Fixed in 9.5.4, 9.4.13, 9.3.16, 9.2.20, 8.5.27
  • Fix · GHSA-mpv3-g8m3-3fjc github.com/grafana/grafana (Go) Fixed in 9.4.13 Advisory →
  • Fix · GHSA-mpv3-g8m3-3fjc github.com/grafana/grafana (Go) Fixed in 9.3.16 Advisory →
  • Fix · GHSA-mpv3-g8m3-3fjc github.com/grafana/grafana (Go) Fixed in 9.2.20 Advisory →
  • Fix · GHSA-mpv3-g8m3-3fjc github.com/grafana/grafana (Go) Fixed in 8.5.27 Advisory →

Red Hat 4 advisories

  • RHSA-2024:3925 Released 2024-06-14 · Red Hat rating Critical
    Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update
    • Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-194.el8cp, ceph-2:18.2.1-194.el9cp, ceph-base-2:18.2.1-194.el8cp +47
  • RHSA-2023:6972 Released 2023-11-14 · Red Hat rating Moderate
    grafana security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-7.el8_9
  • RHSA-2023:6420 Released 2023-11-07 · Red Hat rating Moderate
    grafana security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-7.el9_3
Show 1 more Red Hat advisories
  • RHSA-2023:4030 Released 2023-07-12 · Red Hat rating Critical
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.0.9-3.el9_2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2024:3925
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:6972
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:4030
Not affected: 7 products
  • Cryostat 2
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 7.1 Tools
  • Red Hat OpenShift Container Platform 4
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3128
  2. 2026-10-03 Alias added: GHSA-mpv3-g8m3-3fjc

References

Advisory 4

Other 4

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
  • TI-2022-13141 Stored XSS in Grafana's Unified Alerting CVSS 3.1HIGH 8.7
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences