Vulnerability-Lookup

CVE-2026-17183 (GCVE-0-2026-17183)

Vulnerability from cvelistv5 – Published: 2026-08-19 17:30 – Updated: 2026-08-27 17:22

Title

CVE-2026-17183 CVE Record

Summary

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:40 UTC

CWE

CWE-863 - INCORRECT AUTHORIZATION

Assigner

GRAFANA CNA under the mitre root

CNA scorecard C 73/100 over 59 records in the last 180 days details

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
Grafana	Grafana OSS	Affected: 8.4.0 , < 12.3.11 (semver) Affected: 12.4.0 , < 12.4.9 (semver) Affected: 13.0.0 , < 13.0.7 (semver) Affected: 13.1.0 , < 13.1.4 (semver)	guessed
Grafana	Grafana Enterprise	Affected: 8.4.0 , < 12.3.11 (semver) Affected: 12.4.0 , < 12.4.9 (semver) Affected: 13.0.0 , < 13.0.7 (semver) Affected: 13.1.0 , < 13.1.4 (semver)	guessed

Date Public

2026-07-24 18:38

Credits

czarflix

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:40:28.206524Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:42:03.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.11",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.9",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.7",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.4",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.11",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.9",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.7",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.4",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "czarflix"
        }
      ],
      "datePublic": "2026-07-24T18:38:02.945Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: INCORRECT AUTHORIZATION",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:22:31.524Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-17183 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-17183",
    "datePublished": "2026-08-19T17:30:06.798Z",
    "dateReserved": "2026-07-24T18:38:02.221Z",
    "dateUpdated": "2026-08-27T17:22:31.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-17183",
      "date": "2026-11-13",
      "epss": "0.00285",
      "percentile": "0.21234"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Grafana OSS",
                "vendor": "Grafana",
                "versions": [
                  {
                    "lessThan": "12.3.11",
                    "status": "affected",
                    "version": "8.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.4.9",
                    "status": "affected",
                    "version": "12.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "13.0.7",
                    "status": "affected",
                    "version": "13.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "13.1.4",
                    "status": "affected",
                    "version": "13.1.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Grafana Enterprise",
                "vendor": "Grafana",
                "versions": [
                  {
                    "lessThan": "12.3.11",
                    "status": "affected",
                    "version": "8.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "12.4.9",
                    "status": "affected",
                    "version": "12.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "13.0.7",
                    "status": "affected",
                    "version": "13.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "13.1.4",
                    "status": "affected",
                    "version": "13.1.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@grafana.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource."
          },
          {
            "lang": "es",
            "value": "Un usuario autenticado con permiso para crear o editar reglas de alerta puede eludir la autorizaci\u00f3n de consulta de la fuente de datos al marcar una consulta de regla de alerta como una expresi\u00f3n del lado del servidor mientras hace referencia a un UID de fuente de datos real (autorizaci\u00f3n incorrecta). Esto puede exponer datos accesibles a trav\u00e9s de las credenciales de la fuente de datos configuradas de Grafana a usuarios que carecen de permiso para consultar esa fuente de datos."
          }
        ],
        "id": "CVE-2026-17183",
        "lastModified": "2026-10-26T11:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security@grafana.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-17183",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:40:28.206524Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-19T18:16:35.940",
        "references": [
          {
            "source": "security@grafana.com",
            "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
          }
        ],
        "sourceIdentifier": "security@grafana.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security@grafana.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-11T18:36:42+00:00",
      "cve": "CVE-2026-17183",
      "id": "CVE-2026-17183",
      "initial_release_date": "2026-08-19T17:30:06.798000+00:00",
      "product_status:fixed": "64",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "18",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana: Grafana: Information disclosure vulnerability in Unified Alerting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17183.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-17183",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-19T18:40:28.206524Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-19T18:42:00.562Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Grafana OSS",
              "vendor": "Grafana",
              "versions": [
                {
                  "lessThan": "12.3.11",
                  "status": "affected",
                  "version": "8.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.4.9",
                  "status": "affected",
                  "version": "12.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "13.0.7",
                  "status": "affected",
                  "version": "13.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "13.1.4",
                  "status": "affected",
                  "version": "13.1.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Grafana Enterprise",
              "vendor": "Grafana",
              "versions": [
                {
                  "lessThan": "12.3.11",
                  "status": "affected",
                  "version": "8.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "12.4.9",
                  "status": "affected",
                  "version": "12.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "13.0.7",
                  "status": "affected",
                  "version": "13.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "13.1.4",
                  "status": "affected",
                  "version": "13.1.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "czarflix"
            }
          ],
          "datePublic": "2026-07-24T18:38:02.945Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: INCORRECT AUTHORIZATION",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T08:50:19.087Z",
            "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
            "shortName": "GRAFANA"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
            }
          ],
          "source": {
            "discovery": "BUG_BOUNTY"
          },
          "title": "CVE-2026-17183 CVE Record",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "assignerShortName": "GRAFANA",
        "cveId": "CVE-2026-17183",
        "datePublished": "2026-08-19T17:30:06.798Z",
        "dateReserved": "2026-07-24T18:38:02.221Z",
        "dateUpdated": "2026-08-26T08:50:19.087Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2026:89732 (CVE-2026-17183)

Vulnerability from osv_almalinux – Published: 2026-10-26 00:00 – Updated: 2026-10-26 19:44 – Source website

Summary

Important: grafana security update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:89732	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-17183	REPORT
	https://access.redhat.com/security/cve/CVE-2026-94440	REPORT
	https://bugzilla.redhat.com/2519801	REPORT
	https://bugzilla.redhat.com/2548341	REPORT
	https://errata.almalinux.org/10/ALSA-2026-89732.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-28.el10_2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "grafana-selinux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-28.el10_2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)\n  * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:89732",
  "modified": "2026-10-26T19:44:18Z",
  "published": "2026-10-26T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:89732"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-17183"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519801"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2548341"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-89732.html"
    }
  ],
  "related": [
    "CVE-2026-17183",
    "CVE-2026-94440"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: grafana security update",
  "upstream": [
    "CVE-2026-17183",
    "CVE-2026-94440"
  ]
}

ALSA-2026:89744 (CVE-2026-111943)

Vulnerability from osv_almalinux – Published: 2026-10-26 00:00 – Updated: 2026-10-26 19:23 – Source website

Summary

Critical: grafana security update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:89744	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-111943	REPORT
	https://access.redhat.com/security/cve/CVE-2026-17183	REPORT
	https://access.redhat.com/security/cve/CVE-2026-78667	REPORT
	https://access.redhat.com/security/cve/CVE-2026-78669	REPORT
	https://access.redhat.com/security/cve/CVE-2026-97031	REPORT
	https://bugzilla.redhat.com/2519801	REPORT
	https://bugzilla.redhat.com/2548334	REPORT
	https://bugzilla.redhat.com/2548336	REPORT
	https://bugzilla.redhat.com/2548344	REPORT
	https://bugzilla.redhat.com/2556068	REPORT
	https://errata.almalinux.org/9/ALSA-2026-89744.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-23.el9_8.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "grafana-selinux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.6-23.el9_8.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:89744",
  "modified": "2026-10-26T19:23:34Z",
  "published": "2026-10-26T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:89744"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-17183"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519801"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2548334"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2548336"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2548344"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2556068"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-89744.html"
    }
  ],
  "related": [
    "CVE-2026-111943",
    "CVE-2026-17183",
    "CVE-2026-78667",
    "CVE-2026-78669",
    "CVE-2026-97031"
  ],
  "schema_version": "1.7.0",
  "summary": "Critical: grafana security update",
  "upstream": [
    "CVE-2026-111943",
    "CVE-2026-17183",
    "CVE-2026-78667",
    "CVE-2026-78669",
    "CVE-2026-97031"
  ]
}

ALSA-2026:99030 (CVE-2026-116591)

Vulnerability from osv_almalinux – Published: 2026-11-11 00:00 – Updated: 2026-11-12 21:45 – Source website

Summary

Important: grafana security update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:99030	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-116591	REPORT
	https://access.redhat.com/security/cve/CVE-2026-17183	REPORT
	https://bugzilla.redhat.com/2519801	REPORT
	https://bugzilla.redhat.com/2561461	REPORT
	https://errata.almalinux.org/8/ALSA-2026-99030.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.10-38.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "grafana-selinux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.10-38.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183)\n  * github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:99030",
  "modified": "2026-11-12T21:45:16Z",
  "published": "2026-11-11T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:99030"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-116591"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-17183"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519801"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2561461"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-99030.html"
    }
  ],
  "related": [
    "CVE-2026-116591",
    "CVE-2026-17183"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: grafana security update",
  "upstream": [
    "CVE-2026-116591",
    "CVE-2026-17183"
  ]
}

bit-grafana-2026-17183

Vulnerability from bitnami_vulndb

Published

2026-08-25 08:41

Modified

2026-08-25 09:03

Summary

CVE-2026-17183 CVE Record

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "grafana",
        "purl": "pkg:bitnami/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.4.0"
            },
            {
              "fixed": "12.3.11"
            },
            {
              "introduced": "12.4.0"
            },
            {
              "fixed": "12.4.9"
            },
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.0.7"
            },
            {
              "introduced": "13.1.0"
            },
            {
              "fixed": "13.1.4"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-17183"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
      "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
  },
  "details": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource.",
  "id": "BIT-grafana-2026-17183",
  "modified": "2026-08-25T09:03:39.364Z",
  "published": "2026-08-25T08:41:58.852Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17183"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "CVE-2026-17183 CVE Record"
}

FKIE_CVE-2026-17183

Vulnerability from fkie_nvd - Published: 2026-08-19 18:16 - Updated: 2026-10-26 11:10

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security@grafana.com	https://grafana.com/security/security-advisories/cve-2026-17183

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.11",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.9",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.7",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.4",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.3.11",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.9",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.7",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.1.4",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@grafana.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource."
    },
    {
      "lang": "es",
      "value": "Un usuario autenticado con permiso para crear o editar reglas de alerta puede eludir la autorizaci\u00f3n de consulta de la fuente de datos al marcar una consulta de regla de alerta como una expresi\u00f3n del lado del servidor mientras hace referencia a un UID de fuente de datos real (autorizaci\u00f3n incorrecta). Esto puede exponer datos accesibles a trav\u00e9s de las credenciales de la fuente de datos configuradas de Grafana a usuarios que carecen de permiso para consultar esa fuente de datos."
    }
  ],
  "id": "CVE-2026-17183",
  "lastModified": "2026-10-26T11:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security@grafana.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-17183",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-19T18:40:28.206524Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-19T18:16:35.940",
  "references": [
    {
      "source": "security@grafana.com",
      "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
    }
  ],
  "sourceIdentifier": "security@grafana.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security@grafana.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F74R-H7QJ-C63F

Vulnerability from github – Published: 2026-08-19 18:32 – Updated: 2026-08-19 18:32

Details

Summary

An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to expr while retaining the UID of a real datasource.

The alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid.

Impact

This bypass can expose data accessible through Grafana's configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High.

Integrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated.

Attack prerequisites

Authenticated, low-privileged user in the same Grafana organization
Permission to create or edit alert rules in an accessible folder
No datasources:query permission for the targeted datasource
Knowledge or discovery of the targeted datasource UID
No user interaction required

Technical details / root cause

The attacker submits an alert-rule query with queryType: "expr" and the UID of a real datasource.
The datasource authorization helper skips permission enforcement when query.QueryType == "expr".
queryType is client-controlled and is not validated against the referenced datasource.
During evaluation, Grafana selects and loads the actual datasource using DatasourceUID, not the spoofed queryType.
The query therefore executes using Grafana's datasource credentials despite the caller lacking datasources:query.

The root cause is inconsistent query classification between authorization and execution: authorization trusts queryType, while execution trusts DatasourceUID.

Affected product / component

Product: Grafana OSS
Component: Unified Alerting / ngalert
Area: Alert-rule datasource authorization and query evaluation
Confirmed version: Grafana OSS 13.0.1
Affected version range: not yet assessed

Severity

CVSS 3.1: 7.1 High
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE-863: Incorrect Authorization

Scope is Unchanged because the vulnerable authorization decision and resulting impact remain within Grafana's security authority.

Source

Researcher: czarflix
Intigriti report: GRAFANALABS-F996ATD7
Report URL: https://app.intigriti.com/company/submissions/GRAFANALABS-F996ATD7

Related report / duplicate assessment

This is a default-Grafana-OSS reproduction of the root cause previously reported in GRAFANALABS-IAQAFIXI. The earlier submission was archived as Not Applicable because its proof of concept depended on Cloud/Enterprise-specific permission mechanisms, and the researcher was invited to demonstrate the issue under default OSS permissions. This report establishes that missing prerequisite and should be treated as the actionable OSS submission, not dismissed as a duplicate.

VUL-2026-0095 and VUL-2026-0126 concern Enterprise Recorded Queries and have different components, endpoints, and root causes; they are related authorization issues but not duplicates.

Recommended remediation

Do not exempt a query from datasource authorization based solely on client-controlled queryType.
Resolve the referenced datasource server-side before authorization and apply datasources:query whenever the resolved UID represents a real datasource.
Require expression queries to reference only the canonical server-side expression datasource and reject mismatches such as queryType: "expr" paired with a real datasource UID.
Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.
Add regression coverage for an OSS user with folder-level alert-rule edit permission but without datasource query permission, including mismatched queryType and datasourceUid values.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-17183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T18:16:35Z",
    "severity": "HIGH"
  },
  "details": "Summary\n\nAn authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource.\n\nThe alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid.\n\n## Impact\n\nThis bypass can expose data accessible through Grafana\u0027s configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High.\n\nIntegrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated.\n\n## Attack prerequisites\n\n- Authenticated, low-privileged user in the same Grafana organization\n- Permission to create or edit alert rules in an accessible folder\n- No datasources:query permission for the targeted datasource\n- Knowledge or discovery of the targeted datasource UID\n- No user interaction required\n\n## Technical details / root cause\n\n1. The attacker submits an alert-rule query with queryType: \"__expr__\" and the UID of a real datasource.\n2. The datasource authorization helper skips permission enforcement when query.QueryType == \"__expr__\".\n3. queryType is client-controlled and is not validated against the referenced datasource.\n4. During evaluation, Grafana selects and loads the actual datasource using DatasourceUID, not the spoofed queryType.\n5. The query therefore executes using Grafana\u0027s datasource credentials despite the caller lacking datasources:query.\n\nThe root cause is inconsistent query classification between authorization and execution: authorization trusts queryType, while execution trusts DatasourceUID.\n\n## Affected product / component\n\n- Product: Grafana OSS\n- Component: Unified Alerting / ngalert\n- Area: Alert-rule datasource authorization and query evaluation\n- Confirmed version: Grafana OSS 13.0.1\n- Affected version range: not yet assessed\n\n## Severity\n\n- CVSS 3.1: 7.1 High\n- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\n- CWE-863: Incorrect Authorization\n\nScope is Unchanged because the vulnerable authorization decision and resulting impact remain within Grafana\u0027s security authority.\n\n## Source\n\n- Researcher: czarflix\n- Intigriti report: GRAFANALABS-F996ATD7\n- Report URL: https://app.intigriti.com/company/submissions/GRAFANALABS-F996ATD7\n\n## Related report / duplicate assessment\n\nThis is a default-Grafana-OSS reproduction of the root cause previously reported in GRAFANALABS-IAQAFIXI. The earlier submission was archived as Not Applicable because its proof of concept depended on Cloud/Enterprise-specific permission mechanisms, and the researcher was invited to demonstrate the issue under default OSS permissions. This report establishes that missing prerequisite and should be treated as the actionable OSS submission, not dismissed as a duplicate.\n\nVUL-2026-0095 and VUL-2026-0126 concern Enterprise Recorded Queries and have different components, endpoints, and root causes; they are related authorization issues but not duplicates.\n\n## Recommended remediation\n\n- Do not exempt a query from datasource authorization based solely on client-controlled queryType.\n- Resolve the referenced datasource server-side before authorization and apply datasources:query whenever the resolved UID represents a real datasource.\n- Require expression queries to reference only the canonical server-side expression datasource and reject mismatches such as queryType: \"__expr__\" paired with a real datasource UID.\n- Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.\n- Add regression coverage for an OSS user with folder-level alert-rule edit permission but without datasource query permission, including mismatched queryType and datasourceUid values.",
  "id": "GHSA-f74r-h7qj-c63f",
  "modified": "2026-08-19T18:32:52Z",
  "published": "2026-08-19T18:32:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17183"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:11684-1

Vulnerability from csaf_opensuse - Published: 2026-09-04 00:00 - Updated: 2026-09-17 17:22

Summary

grafana-12.4.10-1.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2026-17183.

CVE-2026-17183

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:22125-1

Vulnerability from csaf_opensuse - Published: 2026-10-19 16:37 - Updated: 2026-11-10 16:04

Summary

Security update for grafana

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-17183.

CVE-2026-17183

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Recommended: 4 products

Open the full advisory

RHSA-2026:65157

Vulnerability from csaf_redhat - Published: 2026-09-08 08:56 - Updated: 2026-11-11 19:17

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-17183.

CVE-2026-17183

A flaw was found in Grafana's Unified Alerting component. An authenticated user with permissions to create or edit alert rules in a folder can bypass datasource query permissions. By manipulating the `queryType` field, an attacker can execute queries against datasources they are not authorized to access, leading to the disclosure of sensitive data. This vulnerability arises from inconsistent query classification between authorization and execution paths.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:65157

Open the full advisory

RHSA-2026:65537

Vulnerability from csaf_redhat - Published: 2026-09-08 16:15 - Updated: 2026-11-13 13:38

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2026-17183.

CVE-2026-17183

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:65537

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-17183 (GCVE-0-2026-17183)

ALSA-2026:89732 (CVE-2026-17183)

ALSA-2026:89744 (CVE-2026-111943)

ALSA-2026:99030 (CVE-2026-116591)

bit-grafana-2026-17183

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-17183

GHSA-F74R-H7QJ-C63F

Impact

Attack prerequisites

Technical details / root cause

Affected product / component

Severity

Source

Related report / duplicate assessment

Recommended remediation

OPENSUSE-SU-2026:11684-1

OPENSUSE-SU-2026:22125-1

RHSA-2026:65157

RHSA-2026:65537

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour