Description
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana | 8.5.0 – < 9.5.7, 10.0.0 – < 10.0.12, 10.1.0 – < 10.1.8, 10.2.0 – < 10.2.5, 10.3.0 – < 10.3.4 | 9.5.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 8.5.0, < 9.5.7 | 9.5.7 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | >= 10.0.0, < 10.0.12 | 10.0.12 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | >= 10.1.0, < 10.1.8 | 10.1.8 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | >= 10.2.0, < 10.2.5 | 10.2.5 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | >= 10.3.0, < 10.3.4 | 10.3.4 | GHSA-5mxf-42f5-j782 |
| Go | github.com/grafana/grafana | all versions | — | GO-2024-2629 |
Advisories 4
- WID-SEC-2024-0585 Grafana: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- VDE-2026-049 Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-01 CERT@VDE · Jun 30, 2026
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025