CVE-2021-39226 — Snapshot authentication bypass in grafana

Description

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Affected products

Vendor	Product	Affected	Fixed
grafana	grafana	>= 8.0.0, < 8.1.6, < 7.5.11	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	grafana	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	grafana	7.3.6-3.el8_4	RHSA-2021:3771

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.2 EUS	grafana +12	6.3.6-3.el8_2	RHSA-2021:3770
RHEL 8.1 EUS	grafana +12	6.2.2-7.el8_1	RHSA-2021:3769

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	grafana	7.3.6-3.el8_4	RLSA-2021:3771

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP5	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SLES 12 SP4	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SLES 12 SP3	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP5	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SLES for SAP 12 SP4	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SLES for SAP 12 SP3	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE OpenStack Cloud Crowbar 9	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE OpenStack Cloud Crowbar 9	grafana	6.7.4-3.29.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	openstack-heat-templates	0.0.0+git.1654529662.75fa04a7-3.15.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	openstack-horizon-plugin-gbp-ui	14.0.1~dev4-3.12.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron-gbp	14.0.1~dev46-3.34.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	openstack-nova	18.3.1~dev92-3.43.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	python-Django1	1.11.29-3.40.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	rabbitmq-server	3.6.16-4.3.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 9	rubygem-puma	2.16.0-4.18.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud Crowbar 8	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE OpenStack Cloud Crowbar 8	grafana	6.7.4-4.23.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud Crowbar 8	openstack-heat-templates	0.0.0+git.1654529662.75fa04a-3.27.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud Crowbar 8	openstack-murano +1	4.0.2~dev3-3.12.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud Crowbar 8	python-Django	1.11.29-3.42.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud Crowbar 8	rabbitmq-server	3.6.16-3.13.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud Crowbar 8	rubygem-puma	2.16.0-3.18.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 9	ardana-ansible	9.0+git.1660748476.c118d23-3.32.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	ardana-cobbler	9.0+git.1660747489.119efcd-3.19.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	ardana-tempest	9.0+git.1651855288.a2341ad-3.22.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE OpenStack Cloud 9	grafana	6.7.4-3.29.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	openstack-heat-templates	0.0.0+git.1654529662.75fa04a7-3.15.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	openstack-horizon-plugin-gbp-ui	14.0.1~dev4-3.12.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	openstack-neutron-gbp	14.0.1~dev46-3.34.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	openstack-nova	18.3.1~dev92-3.43.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	python-Django1	1.11.29-3.40.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	rabbitmq-server	3.6.16-4.3.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	venv-openstack-heat	11.0.4~dev4-3.37.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	venv-openstack-horizon	14.1.1~dev11-4.41.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	venv-openstack-neutron	13.0.8~dev206-6.41.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 9	venv-openstack-nova	18.3.1~dev92-3.41.1	SUSE-SU-2022:3339-1
SUSE OpenStack Cloud 8	ardana-ansible	8.0+git.1660773729.3789a6d-3.85.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	ardana-cobbler	8.0+git.1660773402.d845a45-3.47.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE OpenStack Cloud 8	grafana	6.7.4-4.23.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	openstack-heat-templates	0.0.0+git.1654529662.75fa04a-3.27.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	openstack-murano +1	4.0.2~dev3-3.12.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	python-Django	1.11.29-3.42.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	rabbitmq-server	3.6.16-3.13.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.45.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	venv-openstack-horizon	12.0.5~dev6-14.48.1	SUSE-SU-2022:3338-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev3-12.38.1	SUSE-SU-2022:3338-1
SUSE Manager Server Module 4.2	prometheus-postgres_exporter	0.10.0-150000.1.3.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	grafana	7.5.12-1.27.1	SUSE-SU-2022:1396-1, SUSE-SU-2022:0139-1
SUSE Manager Client Tools 15	mgr-cfg	4.2.8-150000.1.24.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	mgr-osad	4.2.8-150000.1.36.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	mgr-push	4.2.5-150000.1.18.2	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	mgr-virtualization	4.2.4-150000.1.26.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	prometheus-postgres_exporter	0.10.0-150000.1.3.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	rhnlib	4.2.6-150000.3.34.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	spacecmd	4.2.16-150000.3.77.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	spacewalk-client-tools	4.2.18-150000.3.59.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	spacewalk-koan	4.2.6-150000.3.27.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	spacewalk-oscap	4.2.4-150000.3.18.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 15	suseRegisterInfo	4.2.6-150000.3.21.1	SUSE-SU-2022:1396-1
SUSE Manager Client Tools 12	golang-github-QubitProducts-exporter_exporter	0.4.0-1.6.1	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	golang-github-boynux-squid_exporter	1.6-4.9.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-lusitaniae-apache_exporter	1.0.0-4.12.4	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-alertmanager	0.23.0-1.12.3	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	golang-github-prometheus-prometheus	2.45.0-4.33.3	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-promu	0.14.0-4.12.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	grafana	7.5.12-1.27.1	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1, SUSE-SU-2022:0138-1
SUSE Manager Client Tools 12	kiwi-desc-saltboot	0.1.1687520761.cefb248-4.15.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	mgr-cfg	4.3.6-1.27.4	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	mgr-custom-info	4.3.3-1.18.1	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	mgr-daemon	4.3.4-1.32.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	mgr-osad	4.3.6-1.39.4	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	mgr-push	4.3.4-1.21.4	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	mgr-virtualization	4.3.5-1.29.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	prometheus-blackbox_exporter	0.19.0-1.8.2	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	prometheus-postgres_exporter	0.10.0-1.8.2	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	python-hwdata	2.3.5-12.9.1	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	rhnlib	4.3.4-21.43.3	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	spacecmd	4.3.11-38.103.3	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	spacewalk-client-tools	4.3.9-52.71.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	spacewalk-koan	4.3.5-24.33.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	spacewalk-oscap	4.3.5-19.27.1	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	spacewalk-remote-utils	4.3.3-24.24.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	supportutils-plugin-salt	1.2.0-6.16.1	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	supportutils-plugin-susemanager-client	4.3.2-6.24.1	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	suseRegisterInfo	4.3.3-25.27.3	SUSE-SU-2022:2134-1
SUSE Manager Client Tools 12	system-user-grafana +1	1.0.0-3.7.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	uyuni-common-libs	4.3.4-1.21.3	SUSE-SU-2024:0191-1, SUSE-SU-2022:2134-1
SUSE HPE Helion OpenStack 8	ardana-ansible	8.0+git.1660773729.3789a6d-3.85.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	ardana-cobbler	8.0+git.1660773402.d845a45-3.47.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	golang-github-prometheus-node_exporter	1.3.0-1.15.3	SUSE-SU-2022:2134-1
SUSE HPE Helion OpenStack 8	grafana	6.7.4-4.23.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	openstack-heat-templates	0.0.0+git.1654529662.75fa04a-3.27.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	openstack-murano +1	4.0.2~dev3-3.12.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	python-Django	1.11.29-3.42.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	rabbitmq-server	3.6.16-3.13.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.45.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	venv-openstack-horizon-hpe	12.0.5~dev6-14.48.1	SUSE-SU-2022:3338-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev3-12.38.1	SUSE-SU-2022:3338-1
SUSE Enterprise Storage 6	grafana	7.5.12-150100.3.9.1	SUSE-SU-2022:3425-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	grafana	7.5.11-3.1	openSUSE-SU-2024:11651-1
openSUSE Leap 15.4	grafana	8.3.5-150200.3.21.1	SUSE-FU-2022:1419-1
openSUSE Leap 15.3	grafana	7.5.12-3.18.1	openSUSE-SU-2022:0140-1, SUSE-FU-2022:1419-1
openSUSE Leap 15.3	prometheus-postgres_exporter	0.10.0-150000.1.3.1	SUSE-SU-2022:1396-1
openSUSE Leap 15.3	rhnlib	4.2.6-150000.3.34.1	SUSE-SU-2022:1396-1
openSUSE Leap 15.3	spacecmd	4.2.16-150000.3.77.1	SUSE-SU-2022:1396-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	grafana	7.3.6-3.el8_4	ELSA-2021-3771

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Grafana Snapshot - Authentication Bypass http/cves/2021/CVE-2021-39226.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/grafana/grafana	< 7.5.11	7.5.11	GHSA-69j6-29vr-p3j9
Go	github.com/grafana/grafana	>= 8.0.0, < 8.1.6	8.1.6	GHSA-69j6-29vr-p3j9

Advisories 17

RHSA-2021:3771 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2021:3770 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2021:3769 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RLSA-2021:3771 Important: grafana security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-FU-2022:1419-1 Feature update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:0191-1 Security Beta update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2022:0140-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3338-1 Security update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11651-1 grafana-7.5.11-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3425-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3339-1 Security update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:1396-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0139-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:0138-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2134-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-0401 Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 23, 2024
ELSA-2021-3771 Important: grafana security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 12, 2021

CNA	v3.1	9.8
EUVD	v3.1	9.8
OSV:GHSA	v3.1	7.3

Snapshot authentication bypass in grafana

Description

Affected products

Fixed in Linux distributions

Ubuntu

Red Hat

Rocky Linux

SUSE

openSUSE

Oracle Linux

Automated scanner template

Affected packages

Advisories 17

References