Read the docs
TI-2024-01347 Aliases CVE-2024-1442GHSA-5mxf-42f5-j782

User with permissions to create a data source can CRUD all data sources

Priority LOW 39CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00802 56th percentileScored 2026-11-07
Fix Partial Grafana (Grafana): 9.5.7, 10.0.12, 10.1.8 +2github.com/grafana/grafana (Go): 9.5.7, 10.0.12, 10.1.8 +2Red Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GrafanaGrafana8.5.0 to before 9.5.7; 10.0.0 to before 10.0.12; 10.1.0 to before 10.1.8; 10.2.0 to before 10.2.5; 10.3.0 to before 10.3.49.5.7, 10.0.12, 10.1.8, 10.2.5, 10.3.4Patch availableCNA
—github.com/grafana/grafana (Go)8.5.0 to before 9.5.79.5.7Patch availableGHSA-5mxf-42f5-j782
—github.com/grafana/grafana (Go)10.0.0 to before 10.0.1210.0.12Patch availableGHSA-5mxf-42f5-j782
—github.com/grafana/grafana (Go)10.1.0 to before 10.1.810.1.8Patch availableGHSA-5mxf-42f5-j782
—github.com/grafana/grafana (Go)10.2.0 to before 10.2.510.2.5Patch availableGHSA-5mxf-42f5-j782
—github.com/grafana/grafana (Go)10.3.0 to before 10.3.410.3.4Patch availableGHSA-5mxf-42f5-j782
  • Grafana VendorGrafana Affected 8.5.0 to before 9.5.7; 10.0.0 to before 10.0.12; 10.1.0 to before 10.1.8; 10.2.0 to before 10.2.5; 10.3.0 to before 10.3.4 Fixed in 9.5.7, 10.0.12, 10.1.8, 10.2.5, 10.3.4 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 8.5.0 to before 9.5.7 Fixed in 9.5.7 Patch available GHSA-5mxf-42f5-j782
  • github.com/grafana/grafana (Go) Vendor— Affected 10.0.0 to before 10.0.12 Fixed in 10.0.12 Patch available GHSA-5mxf-42f5-j782
  • github.com/grafana/grafana (Go) Vendor— Affected 10.1.0 to before 10.1.8 Fixed in 10.1.8 Patch available GHSA-5mxf-42f5-j782
  • github.com/grafana/grafana (Go) Vendor— Affected 10.2.0 to before 10.2.5 Fixed in 10.2.5 Patch available GHSA-5mxf-42f5-j782
  • github.com/grafana/grafana (Go) Vendor— Affected 10.3.0 to before 10.3.4 Fixed in 10.3.4 Patch available GHSA-5mxf-42f5-j782

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*8.5.0 to before 9.5.7; 10.0.0 to before 10.0.12; 10.1.0 to before 10.1.8; 10.2.0 to before 10.2.5; 10.3.0 to before 10.3.4VulnerableGrafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 8.5.0 to before 9.5.7; 10.0.0 to before 10.0.12; 10.1.0 to before 10.1.8; 10.2.0 to before 10.2.5; 10.3.0 to before 10.3.4 Vulnerable ·Grafana

Remediation

  • Fix · CNA Grafana (Grafana) Fixed in 9.5.7, 10.0.12, 10.1.8, 10.2.5, 10.3.4
  • Fix · GHSA-5mxf-42f5-j782 github.com/grafana/grafana (Go) Fixed in 9.5.7 Advisory →
  • Fix · GHSA-5mxf-42f5-j782 github.com/grafana/grafana (Go) Fixed in 10.0.12 Advisory →
  • Fix · GHSA-5mxf-42f5-j782 github.com/grafana/grafana (Go) Fixed in 10.1.8 Advisory →
  • Fix · GHSA-5mxf-42f5-j782 github.com/grafana/grafana (Go) Fixed in 10.2.5 Advisory →
  • Fix · GHSA-5mxf-42f5-j782 github.com/grafana/grafana (Go) Fixed in 10.3.4 Advisory →

Red Hat 2 advisories

  • RHSA-2024:8974 Released 2024-11-06 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.12.0 security and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
  • RHSA-2024:2633 Released 2024-05-01 · Red Hat rating Important
    updated rhceph-6.1 container image
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 4AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed RHSA-2024:8974
Red Hat Ceph Storage 5.3 ToolsFixed—
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2024:2633
Not affected: 4 products
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 3.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1442
  2. 2026-10-03 Alias added: GHSA-5mxf-42f5-j782
  3. 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools · Red Hat

References

Advisory 3

Other 3

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences