CVE-2026-27877: Public dashboards discloses all direct mode datasources
Modified
AliasesRHSA-2026:10223RHSA-2026:10226RHSA-2026:11416RHSA-2026:11417UBUNTU-CVE-2026-27877CGA-2xp9-mvjf-pgchCGA-34rv-7jwm-v2c3CGA-4768-f9cq-9892CGA-4mmf-37p4-c95hCGA-6vmm-wmjh-r7phCGA-89jv-79jj-24fcCGA-mx3w-ffwx-hfpqCGA-vj9m-h9c7-j9rjGHSA-3q27-7qjq-p9c5BIT-grafana-2026-27877GO-2026-5095CGA-22jr-9f7q-j96vCGA-27vx-8fjc-j3x5CGA-2c43-j4q3-pcfqCGA-32g6-wxmx-4vjhCGA-348j-wgh9-74cqCGA-35q9-p96p-mv47CGA-382g-gh22-j7v7CGA-383r-5qpg-mh5xCGA-3qjv-w9qq-6jh3CGA-3vcm-fw55-4r23CGA-438q-chhx-g5v4CGA-487c-xx2r-hg8cCGA-4cmq-5mgj-53f9CGA-4g63-7qc3-j3r3CGA-4r36-p2w6-6gm6CGA-4vjq-47pc-p692CGA-4vv7-qxqr-mjcpCGA-4xvp-fm57-m9f7CGA-55qf-3wj8-8pr7CGA-5c72-4jfw-x2gvCGA-5q77-8j74-88vpCGA-5qgx-9j8v-fvr2CGA-63qp-q7r9-x9x9CGA-6fxh-5rwp-3qrmCGA-6q2v-c2hf-p8g6CGA-6qw3-wg3q-6f77CGA-74qr-j643-3fwqCGA-77rg-38fq-hhq3CGA-79vj-4cm2-4596CGA-79wp-89cg-p86mCGA-7ccx-vxq9-g4wwCGA-7g76-pjqv-399hCGA-7hr7-cm7g-v7v3CGA-7qrf-hx62-7h7wCGA-7w2m-r9qf-3f4fCGA-7xr2-x2hh-pcvrCGA-88rr-rch8-fhjmCGA-8968-xx7q-jj6fCGA-8q3x-8p6m-g5hqCGA-968c-hvxq-6f7hCGA-9cj9-vhp9-5744CGA-9crr-w7v4-5475CGA-9gr4-7ppc-x4w7CGA-c249-gj89-v8v4CGA-c4m7-c5f9-v9qgCGA-ch8c-94c9-9hhvCGA-cq4j-g2j4-h88gCGA-f348-gx3m-p636CGA-f7w9-wx3g-3625CGA-f86p-m2jc-5hmvCGA-fp9x-55cc-4x9cCGA-frfp-7x63-hx8vCGA-g376-5fqw-h6v8CGA-g6rf-pqpv-w878CGA-g94g-2qqx-q8prCGA-g95c-gw85-8qwgCGA-gqvp-fxq4-v8vwCGA-grwg-327v-55p2CGA-gwr6-c2j5-ww9vCGA-h5rf-6crm-chm2CGA-h983-rv9h-vh3jCGA-hcjj-mf95-m6qxCGA-hh4w-m78v-9xmrCGA-j3c7-gxqm-vh5xCGA-m776-4vhm-f539CGA-mqmm-j5vw-pxf2CGA-pvrq-hrgg-chm3CGA-q6cq-h86h-q5w4CGA-q95m-532v-gmjgCGA-qpqj-47xg-x4x3CGA-r6xr-3cp5-379jCGA-v8h7-hph7-754rCGA-vhmx-r7w3-jp54CGA-vrhq-66wr-46ffCGA-w4p3-mhmg-2ghvCGA-wc93-5w5h-mxwgCGA-wh8r-7cq3-xc92CGA-wwfc-6288-9cqhCGA-x3g9-f3v4-mfqmCGA-x452-p5r4-f7hwCGA-x85x-7v6h-g6g5CGA-x95g-p582-jjj8CGA-xgmp-jh6r-xh7mCGA-xr95-4645-7fp8CGA-xvp9-g6xj-jjhqCGA-xxrg-4377-g4crALPINE-CVE-2026-27877
Published 27-03-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-27877 is a high (CVSS 7.5) vulnerability in grafana. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24.4% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.31%
0%100%
Low · -0.08 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources8 sources · 6.5–7.5
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
Decrease -0.08 pp
From 0.40% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Affected systems
Version check
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard15 products
- grafana-11.5All versions (No fix recorded)
- grafana-11.6All versions (No fix recorded)
- grafana-12.0All versions (No fix recorded)
- grafana-12.1All versions (No fix recorded)
- grafana-12.2All versions (No fix recorded)
Redhat4 products
- grafana< 0:10.2.6-24.el10_1 | < 0:10.2.6-20.el9_7 | < 0:10.2.6-20.el9_6 | < 0:10.2.6-23.el10_0
- grafana-debuginfo< 0:10.2.6-24.el10_1 | < 0:10.2.6-20.el9_7 | < 0:10.2.6-20.el9_6 | < 0:10.2.6-23.el10_0
- grafana-debugsource< 0:10.2.6-24.el10_1 | < 0:10.2.6-20.el9_7 | < 0:10.2.6-20.el9_6 | < 0:10.2.6-23.el10_0
- grafana-selinux< 0:10.2.6-24.el10_1 | < 0:10.2.6-20.el9_7 | < 0:10.2.6-20.el9_6 | < 0:10.2.6-23.el10_0
Alpine1 product
- grafana≥ 11.6.14, < 12.2.8-r0 | ≥ 11.6.14, < 12.4.3-r0
Github.com/grafana1 product
- grafana≥ 9.3.0 (No fix recorded) | ≥ 12.0.0 (No fix recorded) | ≥ 12.2.0 (No fix recorded) | ≥ 12.3.0 (No fix recorded) | ≥ 12.4.0 (No fix recorded) | ≥ 1.9.2-0.20221116104934-4ee83a5f2bf4, < 1.9.2-0.20260325055210-3522153e07b4 | All versions (No fix recorded)
Grafana1 product
- grafana≥ 9.3.0, < 11.6.14 | ≥ 12.0.0, < 12.1.10 | ≥ 12.2.0, < 12.2.8 | ≥ 12.3.0, < 12.3.6 | ≥ 12.4.0, < 12.4.2 | < 9.3.0 | ≥ 11.6.14, < 12.0.0 | ≥ 12.1.10, < 12.2.0 | ≥ 12.2.8, < 12.3.0 | ≥ 12.3.6, < 12.4.0
Ubuntu1 product
- grafanaAll versions (No fix recorded)
Wolfi1 product
- grafana-12.3All versions (No fix recorded)
7 vendors · 24 products
References
22 linksShow all 22 references
- github.com/grafana/grafanaPACKAGE