$ cve CVE-2021-39226 JSON

CVE-2021-39226 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-09-15.

Description

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.93% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-287
On CISA KEV	yes — remediate by 2022-09-15
Public exploit	none known
Published	2021-10-05
Last modified	2026-06-17

CISA KEV

Name	Grafana Authentication Bypass Vulnerability
Added	2022-08-25
Due	2022-09-15
Vendor / product	Grafana Labs / Grafana
Ransomware use	none reported

Affected (2)

Vendor	Product
fedoraproject	fedora
grafana	grafana

References

→ the Explorer · watch your stack · NVD