CVE-2026-17183 — CVE-2026-17183 CVE Record

Description (CNA)

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana OSS	affected 8.4.0 before 12.3.11; affected 12.4.0 before 12.4.9; affected 13.0.0 before 13.0.7; affected 13.1.0 before 13.1.4
Grafana / Grafana Enterprise	affected 8.4.0 before 12.3.11; affected 12.4.0 before 12.4.9; affected 13.0.0 before 13.0.7; affected 13.1.0 before 13.1.4

CWE

CWE-863

References

https://grafana.com/security/security-advisories/cve-2026-17183

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.