Read the docs
TI-2026-17494 Aliases CVE-2026-21721GHSA-jgfq-mgxg-4qwm

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00724 54th percentileScored 2026-11-07
Fix Partial grafana/grafana (Grafana): 12.3.1, 12.2.3, 12.1.5 +2grafana/grafana-enterprise (Grafana): 11.6.9, 12.0.8, 12.1.5 +2Red Hat: 8 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Grafanagrafana/grafana12.3.0 to before 12.3.112.3.1Patch availableCNA
Grafanagrafana/grafana12.2.0 to before 12.2.312.2.3Patch availableCNA
Grafanagrafana/grafana12.1.0 to before 12.1.512.1.5Patch availableCNA
Grafanagrafana/grafana12.0.0 to before 12.0.812.0.8Patch availableCNA
Grafanagrafana/grafana10.2.0 to before 11.6.911.6.9Patch availableCNA
Grafanagrafana/grafana-enterprise10.2.0 to before 11.6.911.6.9Patch availableCNA
Grafanagrafana/grafana-enterprise12.0.0 to before 12.0.812.0.8Patch availableCNA
Grafanagrafana/grafana-enterprise12.1.0 to before 12.1.512.1.5Patch availableCNA
Grafanagrafana/grafana-enterprise12.2.0 to before 12.2.312.2.3Patch availableCNA
Grafanagrafana/grafana-enterprise12.3.0 to before 12.3.112.3.1Patch availableCNA
  • grafana/grafana VendorGrafana Affected 12.3.0 to before 12.3.1 Fixed in 12.3.1 Patch available CNA
  • grafana/grafana VendorGrafana Affected 12.2.0 to before 12.2.3 Fixed in 12.2.3 Patch available CNA
  • grafana/grafana VendorGrafana Affected 12.1.0 to before 12.1.5 Fixed in 12.1.5 Patch available CNA
  • grafana/grafana VendorGrafana Affected 12.0.0 to before 12.0.8 Fixed in 12.0.8 Patch available CNA
  • grafana/grafana VendorGrafana Affected 10.2.0 to before 11.6.9 Fixed in 11.6.9 Patch available CNA
  • grafana/grafana-enterprise VendorGrafana Affected 10.2.0 to before 11.6.9 Fixed in 11.6.9 Patch available CNA
  • grafana/grafana-enterprise VendorGrafana Affected 12.0.0 to before 12.0.8 Fixed in 12.0.8 Patch available CNA
  • grafana/grafana-enterprise VendorGrafana Affected 12.1.0 to before 12.1.5 Fixed in 12.1.5 Patch available CNA
  • grafana/grafana-enterprise VendorGrafana Affected 12.2.0 to before 12.2.3 Fixed in 12.2.3 Patch available CNA
  • grafana/grafana-enterprise VendorGrafana Affected 12.3.0 to before 12.3.1 Fixed in 12.3.1 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*10.2.0 to before 11.6.9; 12.0.0 to before 12.0.8; 12.1.0 to before 12.1.5; 12.2.0 to before 12.2.3VulnerableGrafana
cpe:2.3:a:grafana:grafana:11.6.9:-:*:*:*:*:*:*11.6.9VulnerableGrafana
cpe:2.3:a:grafana:grafana:12.0.8:-:*:*:*:*:*:*12.0.8VulnerableGrafana
cpe:2.3:a:grafana:grafana:12.1.5:-:*:*:*:*:*:*12.1.5VulnerableGrafana
cpe:2.3:a:grafana:grafana:12.2.3:-:*:*:*:*:*:*12.2.3VulnerableGrafana
cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:*:*:*:*12.3.0VulnerableGrafana
cpe:2.3:a:grafana:grafana:12.3.1:-:*:*:*:*:*:*12.3.1VulnerableGrafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 10.2.0 to before 11.6.9; 12.0.0 to before 12.0.8; 12.1.0 to before 12.1.5; 12.2.0 to before 12.2.3 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:11.6.9:-:*:*:*:*:*:* Versions 11.6.9 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:12.0.8:-:*:*:*:*:*:* Versions 12.0.8 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:12.1.5:-:*:*:*:*:*:* Versions 12.1.5 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:12.2.3:-:*:*:*:*:*:* Versions 12.2.3 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·Grafana
  • cpe:2.3:a:grafana:grafana:12.3.1:-:*:*:*:*:*:* Versions 12.3.1 Vulnerable ·Grafana

Remediation

  • Fix · CNA grafana/grafana (Grafana) Fixed in 12.3.1
  • Fix · CNA grafana/grafana (Grafana) Fixed in 12.2.3
  • Fix · CNA grafana/grafana (Grafana) Fixed in 12.1.5
  • Fix · CNA grafana/grafana (Grafana) Fixed in 12.0.8
  • Fix · CNA grafana/grafana (Grafana) Fixed in 11.6.9
  • Fix · CNA grafana/grafana-enterprise (Grafana) Fixed in 11.6.9
  • Fix · CNA grafana/grafana-enterprise (Grafana) Fixed in 12.0.8
  • Fix · CNA grafana/grafana-enterprise (Grafana) Fixed in 12.1.5
  • Fix · CNA grafana/grafana-enterprise (Grafana) Fixed in 12.2.3
  • Fix · CNA grafana/grafana-enterprise (Grafana) Fixed in 12.3.1

Red Hat 8 advisories

  • RHSA-2026:79243 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
  • RHSA-2026:8229 Released 2026-04-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +12
Show 5 more Red Hat advisories
  • RHSA-2026:5633 Released 2026-03-24 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9 +23
  • RHSA-2026:3529 Released 2026-03-02 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana-10.2.6-17.el9_6, grafana-selinux-10.2.6-17.el9_6
  • RHSA-2026:3078 Released 2026-02-23 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana-10.2.6-20.el10_0, grafana-selinux-10.2.6-20.el10_0
  • RHSA-2026:2920 Released 2026-02-18 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-18.el9_7, grafana-selinux-10.2.6-18.el9_7
  • RHSA-2026:2914 Released 2026-02-18 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-10.2.6-22.el10_1, grafana-selinux-10.2.6-22.el10_1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    grafana/grafana, grafana/grafana-enterprise 11.6.9, 12.0.8 and 3 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-17493 Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outPriority MEDIUM 40
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global HubAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2026:5633
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:8229
Red Hat Ceph Storage 8.1Fixed RHSA-2026:79243
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:2914
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:2920
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:3078
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:3529
Not affected: 5 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Ceph Storage 8.1
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21721
  2. 2026-10-03 Alias added: GHSA-jgfq-mgxg-4qwm
  3. 2026-10-09 Fix available: RHSA-2026:79243 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Ceph Storage 8.1 · Red Hat

References

Advisory 1

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences