Description
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana | 9.5.0 – < 9.5.4, 9.4.0 – < 9.4.13, 9.3.0 – < 9.3.16, 9.2.0 – < 9.2.20, 6.7.0 – < 8.5.27 | 9.5.4 |
| Grafana | Grafana Enterprise | 9.5.0 – < 9.5.4, 9.4.0 – < 9.4.13, 9.3.0 – < 9.3.16, 9.2.0 – < 9.2.20, 6.7.0 – < 8.5.27 | 9.5.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | grafana | 9.0.9-3.el9_2 | RHSA-2023:6420, RHSA-2023:4030 |
| RHEL 8 | grafana | 9.2.10-7.el8_9 | RHSA-2023:6972 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-194.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-194.el9cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | cephadm-ansible | 1:3.2.0-1.el9cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | gperftools +1 | 1:2.7-9.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.2-3.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | libunwind | 1.3.1-3.el8cp | RHSA-2024:3925 |
| Red Hat Ceph Storage 7 | thrift | 0.13.0-2.el8cp | RHSA-2024:3925 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | grafana | 9.0.9-3.el9_2.alma | ALSA-2023:4030 |
| AlmaLinux 8 | grafana | 9.2.10-7.el8_9.alma.1 | ALSA-2023:6972 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | grafana | 9.0.9-3.el9_2 | RLSA-2023:4030 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | golang-github-prometheus-promu | 0.17.0-150000.3.24.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP6 | grafana | 10.4.13-150200.3.59.1 | SUSE-SU-2025:0545-1 |
| SLES 15 SP6 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP5 | grafana | 9.5.5-150200.3.44.1 | SUSE-SU-2023:2917-1 |
| SLES 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP4 | grafana | 9.5.5-150200.3.44.1 | SUSE-SU-2023:2917-1 |
| SLES 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES for SAP 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES for SAP 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLE HPC 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLE HPC 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLE HPC 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Server 4.3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Proxy 4.3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1728559936.c16d4fb-150000.1.56.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-tools | 0.1.28-150000.1.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-159000.3.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-boynux-squid_exporter | 1.6-159000.4.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 1.0.0-159000.4.12.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.45.0-159000.6.33.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | grafana | 9.5.5-150000.1.51.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1, SUSE-SU-2023:2915-1 |
| SUSE Manager Client Tools 15 | mgr-push | 5.0.1-159000.4.21.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | prometheus-postgres_exporter | 0.10.1-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | python-hwdata | 2.3.5-159000.5.13.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | python-pyvmomi | 6.7.3-159000.3.6.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | rhnlib | 5.0.1-159000.6.30.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | spacecmd | 5.0.1-159000.6.42.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 5.0.1-159000.6.48.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-salt | 1.2.2-159000.5.9.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-susemanager-client | 5.0.1-159000.6.15.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 5.0.1-159000.3.33.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 | SUSE-SU-2024:0196-1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.28-150000.1.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools 12 | golang-github-QubitProducts-exporter_exporter | 0.4.0-4.6.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-boynux-squid_exporter | 1.6-4.9.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-lusitaniae-apache_exporter | 1.0.0-4.12.4 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.26.0-4.12.4 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.5.0-4.15.4 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.45.0-4.33.3 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-promu | 0.14.0-4.12.2 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | grafana | 9.5.5-1.51.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1, SUSE-SU-2023:2916-1 |
| SUSE Manager Client Tools 12 | kiwi-desc-saltboot | 0.1.1687520761.cefb248-4.15.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | mgr-push | 5.0.1-4.21.4 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | prometheus-blackbox_exporter | 0.24.0-3.6.3 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | prometheus-postgres_exporter | 0.10.1-3.6.4 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | python-hwdata | 2.3.5-15.12.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | rhnlib | 5.0.1-24.30.3 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | spacecmd | 5.0.1-41.42.3 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-salt | 1.2.2-9.9.2 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-susemanager-client | 5.0.1-9.15.2 | SUSE-SU-2025:0524-1, SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | system-user-grafana +1 | 1.0.0-3.7.2 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 5.0.1-3.33.3 | SUSE-SU-2024:0191-1 |
| SUSE Manager Client Tools 12 | uyuni-tools | 0.1.28-1.16.1 | SUSE-SU-2025:0524-1 |
| SUSE Enterprise Storage 7.1 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 10.0.1-1.1 | openSUSE-SU-2024:13018-1 |
| openSUSE Leap 15.6 | dracut-saltboot | 0.1.1728559936.c16d4fb-150000.1.56.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-promu | 0.17.0-150000.3.24.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | grafana | 10.4.13-150200.3.59.1 | SUSE-SU-2025:0545-1 |
| openSUSE Leap 15.6 | spacecmd | 5.0.11-150000.3.130.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | supportutils-plugin-susemanager-client | 5.0.4-150000.3.27.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.5 | grafana | 9.5.5-150200.3.44.1 | SUSE-SU-2023:2917-1 |
| openSUSE Leap 15.4 | grafana | 9.5.5-150200.3.44.1 | SUSE-SU-2023:2917-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | grafana | 9.0.9-3.el9_2 | ELSA-2023-4030 |
| Oracle Linux 8 | grafana | 9.2.10-7.el8_9 | ELSA-2023-6972 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
spyata123/CVE-2023-3128 ★ 0 · Apr 13, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 9.4.0, < 9.4.13 | 9.4.13 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | >= 9.3.0, < 9.3.16 | 9.3.16 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | >= 9.0.0, < 9.2.20 | 9.2.20 | GHSA-mpv3-g8m3-3fjc |
| Go | github.com/grafana/grafana | < 8.5.27 | 8.5.27 | GHSA-mpv3-g8m3-3fjc |
Advisories 20
- ALSA-2023:4030 Critical: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:6972 Moderate: grafana security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:6420 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3925 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:6972 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:4030 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- VDE-2026-049 Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-01 CERT@VDE · Jun 30, 2026
- RLSA-2023:4030 Critical: grafana security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2025:0524-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0191-1 Security Beta update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13018-1 grafana-10.0.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0545-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2915-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0525-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2916-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2917-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0196-1 Security Beta update for SUSE Manager Client Tools and Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1551 Grafana: Schwachstelle ermöglicht Übernahme von Benutzerkonto BSI CERT-Bund (WID) · Feb 13, 2025
- ELSA-2023-6972 Moderate: grafana security and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-4030 Critical: grafana security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 19, 2023