Description
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Correlations | 10.2.0 – < 12.4.0 | 12.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | < 1.9.2-0.20260127141016-e702db6096e0 | 1.9.2-0.20260127141016-e702db6096e0 | GHSA-p5x9-j974-rpfp |
| Go | github.com/grafana/grafana | all versions | — | GO-2026-6664 |
Advisories 1
- WID-SEC-2026-0300 Grafana: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 15, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-21727 vendor-advisory