Read the docs
TI-2025-03033 Aliases CVE-2025-3454GHSA-9j65-rv5x-4vrf

Improper authorization in Grafana

Priority LOW 23CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00459 39th percentileScored 2026-11-07
Fix Fixed Grafana (Grafana): 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01 +3Grafana Enterprise (Grafana): 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01 +3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GrafanaGrafana11.6.0 to before 11.6.0+security-01; 11.5.0 to before 11.5.3+security-01; 11.4.0 to before 11.4.3+security-01; 11.3.0 to before 11.3.5+security-01; 11.2.0 to before 11.2.8+security-01; 10.4.0 to before 10.4.17+security-0111.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01Patch availableCNA
GrafanaGrafana Enterprise11.6.0 to before 11.6.0+security-01; 11.5.0 to before 11.5.3+security-01; 11.4.0 to before 11.4.3+security-01; 11.3.0 to before 11.3.5+security-01; 11.2.0 to before 11.2.8+security-01; 10.4.0 to before 10.4.17+security-0111.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01Patch availableCNA
—github.com/grafana/grafana (Go)0.0.0-20210414170620-dadccdda06e6 to before 0.0.0-20250424191517-1f707d16ed5d0.0.0-20250424191517-1f707d16ed5dPatch availableGHSA-9j65-rv5x-4vrf
  • Grafana VendorGrafana Affected 11.6.0 to before 11.6.0+security-01; 11.5.0 to before 11.5.3+security-01; 11.4.0 to before 11.4.3+security-01; 11.3.0 to before 11.3.5+security-01; 11.2.0 to before 11.2.8+security-01; 10.4.0 to before 10.4.17+security-01 Fixed in 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01 Patch available CNA
  • Grafana Enterprise VendorGrafana Affected 11.6.0 to before 11.6.0+security-01; 11.5.0 to before 11.5.3+security-01; 11.4.0 to before 11.4.3+security-01; 11.3.0 to before 11.3.5+security-01; 11.2.0 to before 11.2.8+security-01; 10.4.0 to before 10.4.17+security-01 Fixed in 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 0.0.0-20210414170620-dadccdda06e6 to before 0.0.0-20250424191517-1f707d16ed5d Fixed in 0.0.0-20250424191517-1f707d16ed5d Patch available GHSA-9j65-rv5x-4vrf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*——Grafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions — — ·Grafana

Remediation

  • Fix · CNA Grafana (Grafana) Fixed in 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01
  • Fix · CNA Grafana Enterprise (Grafana) Fixed in 11.6.0+security-01, 11.5.3+security-01, 11.4.3+security-01, 11.3.5+security-01, 11.2.8+security-01, 10.4.17+security-01
  • Fix · GHSA-9j65-rv5x-4vrf github.com/grafana/grafana (Go) Fixed in 0.0.0-20250424191517-1f707d16ed5d Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3454
  2. 2026-10-03 Alias added: GHSA-9j65-rv5x-4vrf

References

Advisory 1

Other 5

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 174 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences