Description
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Elasticsearch Datasource | 12.4.2 <12.9.6 | — |
| Grafana | Grafana OSS | 12.0.0 ≤12.2.10 | — |
| Grafana | Grafana OSS | 12.4.0 <12.4.15 | — |
| Grafana | Grafana Enterprise | 12.0.0 ≤12.2.10 | — |
| Grafana | Grafana OSS | 10.1.0 ≤11.6.16 | — |
| Grafana | Grafana OSS | 12.3.0 ≤12.3.11 | — |
| Grafana | Grafana Enterprise | 10.1.0 ≤11.6.16 | — |
| Grafana | Grafana Enterprise | 12.4.0 <12.4.15 | — |
| Grafana | Grafana Enterprise | 12.3.0 ≤12.3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.9-0.1.hum1 | RHSA-2026:95953 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.5-0.1.hum1 | RHSA-2026:99114 |
Advisories 2
- RHSA-2026:99114 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95953 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026