Advisoriesby IbisGrafana LabsCVE-2026-17183
Grafana: improper authorization
Fix: upgrade to OSS 12.3.11 or later (4 fixed versions below)
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Grafana Enterprise Product | >= 8.4.0, < 12.3.11 | 12.3.11 |
| >= 12.4.0, < 12.4.9 | 12.4.9 | |
| >= 13.0.0, < 13.0.7 | 13.0.7 | |
| >= 13.1.0, < 13.1.4 | 13.1.4 | |
| Grafana OSS Product | >= 8.4.0, < 12.3.11 | 12.3.11 |
| >= 12.4.0, < 12.4.9 | 12.4.9 | |
| >= 13.0.0, < 13.0.7 | 13.0.7 | |
| >= 13.1.0, < 13.1.4 | 13.1.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-863