Skip to content
OpenAdvisories
Medium WID-SEC-2026-3675 2 CVEs

Grafana: Mehrere Schwachstellen

Published Sep 30, 2026 · Updated Oct 5, 2026 · Revision 2 · de-DE

Vendor: Grafana Vendor: Red Hat Product: Enterprise Linux Product: Grafana Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen und Daten zu manipulieren.

Product

Grafana ist eine Analyse- und Visualisierungssoftware.

Vulnerabilities 2

  • Medium 5.4
    CVE-2026-13720

    Editor can forge file-provisioning provenance on dashboards via the dashboard API

    An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The da…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 4.3
    CVE-2026-13719

    Alert rules in restricted folders disclosed via the alert rules list API

    An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organizati…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References