Description
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3 | 12.4.12 |
| Grafana | Grafana OSS | 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3 | 12.4.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.2.hum1 | RHSA-2026:74164 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.7-0.1.hum1 | RHSA-2026:76448 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.3-0.1.hum1 | RHSA-2026:76430 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.14-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
Advisories 4
- RHSA-2026:76448 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76430 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74164 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-3675 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 5, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-13719 vendor-advisory