Description (CNA)
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Grafana / Grafana | affected 9.3.0 before 11.6.14; affected 12.0.0 before 12.1.10; affected 12.2.0 before 12.2.8; affected 12.3.0 before 12.3.6; affected 12.4.0 before 12.4.2 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
A flaw was found in Grafana. When public dashboards are used with direct data-sources, sensitive credentials, specifically passwords for all direct data-sources, are exposed. This information disclosure occurs even when these data-sources are not actively utilized in the dashboards. A remote attacker could exploit this to gain unauthorized access to other systems.
- https://access.redhat.com/security/cve/CVE-2026-27877
- https://bugzilla.redhat.com/show_bug.cgi?id=2452293
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27877.json
- https://access.redhat.com/errata/RHSA-2026:11417
- https://access.redhat.com/errata/RHSA-2026:10223
- https://access.redhat.com/errata/RHSA-2026:19134
- https://access.redhat.com/errata/RHSA-2026:11416
- https://access.redhat.com/errata/RHSA-2026:10226
- https://access.redhat.com/errata/RHSA-2026:19352