Authorization bypass in Grafana contact points via schema downgrade
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
Grafana Enterprise and Grafana OSS from 12.4.0 through 12.4.13, from 13.0.0 through 13.0.11, from 13.1.0 through 13.1.8 and from 13.2.0 through 13.2.4 are affected. A user who may edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version (CWE-863). This can expose stored credentials and redirect alert notifications. CISA's KEV catalog does not list the issue, and the references include no exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-11-01
Description from the CNA
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed for Grafana Enterprise or Grafana OSS. Red Hat rates the issue Important and lists Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, 8 and 9, Red Hat Enterprise Linux 10 and Red Hat Hardened Images as affected with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-01
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Global Hub | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix yet |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
Timeline
- 2026-10-28 Threatist record created from CVE-2026-100105
- 2026-10-28 Alias added: GHSA-92gx-p2qg-82fw
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-31 Affected versions changed · Red Hat
- 2026-10-31 CVSS score added · Red Hat
- 2026-10-31 Affected versions changed · Red Hat
- 2026-11-05 CISA SSVC decision points changed
References
More Grafana vulnerabilities
- TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
Sources
- CVE-2026-100105 · CVE Program
- CVE-2026-100105 · NVD
- FIRST EPSS
- GHSA-92gx-p2qg-82fw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-100105 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences