CVE-2022-39328: grafana Race Condition
Vulnerability summary
CVE-2022-39328 is a critical (CVSS 9.8) Race Condition vulnerability in grafana. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-11-2022PublishedVulnerability first disclosed.
- 28-01-2026Last modifiedVulnerability information updated.
Description
Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.04 pp
From 1.04% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- grafana-fips-11.6All versions (No fix recorded)
- grafana-fips-12.0< 12.0.10-r6
- grafana-fips-12.1< 12.1.10.01-r3
- grafana-fips-12.2All versions (No fix recorded)
- grafana-fips-12.3All versions (No fix recorded)
Github.com/grafana1 product
- grafana≥ 9.2.0, < 9.2.4 | All versions (No fix recorded)
Grafana1 product
- grafana≥ 9.2.0, < 9.2.4
Ubuntu1 product
- grafanaAll versions (No fix recorded)
4 vendors · 11 products
References
8 links
- github.com/grafana/grafanaPACKAGE