{"schemaVersion":3,"id":"CVE-2026-15815","aliases":["CGA-64vq-hm2w-7gv7","CGA-w279-42hv-xmfj","RHSA-2026:83544"],"status":"published","duplicateOf":null,"title":null,"description":"Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\n\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS.","dates":{"published":"2026-09-17T20:47:01.006Z","modified":"2026-09-19T03:56:26.777Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true}]},"epss":{"probability":0.00685,"percentile":0.52023,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":-0.1809999999999999,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00866},"history":[{"date":"2026-09-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00685,"percentile":0.52023}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0066,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00685,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00685,"percentile":0.52023}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"},{"id":"CWE-59","name":"Improper Link Resolution Before File Access ('Link Following')","description":"The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/59.html"},{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"chainguard","product":"grafana-11.6","name":"grafana-11.6","label":"grafana-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"grafana","product":"grafana enterprise","name":"Grafana Enterprise","label":"grafana enterprise","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 11.6.0, ≤ 11.6.17","noFixRecorded":false,"fixedIn":null},{"text":"12.0.0","noFixRecorded":false,"fixedIn":null},{"text":"12.1.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.0","noFixRecorded":false,"fixedIn":null},{"text":"12.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.4.0, ≤ 12.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0.0, ≤ 13.0.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, ≤ 13.1.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, ≤ 13.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.6.0, ≤ 11.6.17 | 12.0.0 | 12.1.0 | 12.2.0 | 12.3.0 | ≥ 12.4.0, ≤ 12.4.10 | ≥ 13.0.0, ≤ 13.0.8 | ≥ 13.1.0, ≤ 13.1.5 | ≥ 13.2.0, ≤ 13.2.1","eol":null,"hubHref":"/vendor/grafana/grafana_enterprise"},{"vendor":"grafana","product":"grafana oss","name":"Grafana OSS","label":"grafana oss","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 11.6.0, ≤ 11.6.17","noFixRecorded":false,"fixedIn":null},{"text":"12.0.0","noFixRecorded":false,"fixedIn":null},{"text":"12.1.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.0","noFixRecorded":false,"fixedIn":null},{"text":"12.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.4.0, ≤ 12.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0.0, ≤ 13.0.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, ≤ 13.1.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, ≤ 13.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.6.0, ≤ 11.6.17 | 12.0.0 | 12.1.0 | 12.2.0 | 12.3.0 | ≥ 12.4.0, ≤ 12.4.10 | ≥ 13.0.0, ≤ 13.0.8 | ≥ 13.1.0, ≤ 13.1.5 | ≥ 13.2.0, ≤ 13.2.1","eol":null,"hubHref":"/vendor/grafana/grafana_oss"},{"vendor":"redhat","product":"grafana","name":"grafana","label":"grafana","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana","purlType":"rpm","versions":[{"text":"< 0:9.2.10-35.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:9.2.10-35.el8_10","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-debuginfo","name":"grafana-debuginfo","label":"grafana-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-debuginfo","purlType":"rpm","versions":[{"text":"< 0:9.2.10-35.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:9.2.10-35.el8_10","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-debugsource","name":"grafana-debugsource","label":"grafana-debugsource","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-debugsource","purlType":"rpm","versions":[{"text":"< 0:9.2.10-35.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:9.2.10-35.el8_10","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-selinux","name":"grafana-selinux","label":"grafana-selinux","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-selinux","purlType":"rpm","versions":[{"text":"< 0:9.2.10-35.el8_10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:9.2.10-35.el8_10","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-15815","label":"grafana.com/security/security-advisories/cve-2026-15815","hostname":"grafana.com","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83544","label":"access.redhat.com/errata/RHSA-2026:83544","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527474","label":"bugzilla.redhat.com/show_bug.cgi?id=2527474","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83544.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83544.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15815","label":"access.redhat.com/security/cve/CVE-2026-15815","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15815","label":"www.cve.org/CVERecord?id=CVE-2026-15815","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15815","label":"nvd.nist.gov/vuln/detail/CVE-2026-15815","hostname":"nvd.nist.gov","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11920-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:11920-1"]},"timeline":[{"kind":"published","date":"2026-09-17T20:47:01.006Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-19T03:56:26.777Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:33:14.860Z","stale":false,"partial":false}}