7.1

CVE-2026-9703: grafana grafana enterprise Improper Access Control

CVSS: 7.1v3.1HighAwaiting analysis
Published 15-10-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-9703 is a high (CVSS 7.1) Improper Access Control vulnerability in grafana grafana enterprise. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.6% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.19%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-10-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

16-10-202619-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Grafana2 products
  • grafana enterprise≥ 8.0.0, ≤ 11.5.10 | ≥ 11.6.0, ≤ 11.6.16 | ≥ 12.0.0, ≤ 12.1.10 | ≥ 12.2.0, ≤ 12.2.10 | ≥ 12.3.0, ≤ 12.3.8 | ≥ 12.4.0, ≤ 12.4.5 | ≥ 13.0.0, ≤ 13.0.3
  • grafana oss≥ 12.3.0, ≤ 12.3.8 | ≥ 12.4.0, ≤ 12.4.5 | ≥ 8.0.0, ≤ 12.3.0 | ≥ 13.0.0, ≤ 13.0.3

1 vendor · 2 products

References

1 links