Description
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0 – ≤ 11.6.17, 12.0.0 – ≤ 12.0.10, 12.1.0 – ≤ 12.1.10, 12.2.0 – ≤ 12.2.11, 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3 | 12.4.12 |
| Grafana | Grafana OSS | 11.6.0 – ≤ 11.6.17, 12.0.0 – ≤ 12.0.10, 12.1.0 – ≤ 12.1.10, 12.2.0 – ≤ 12.2.11, 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3 | 12.4.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.2.hum1 | RHSA-2026:74164 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.7-0.1.hum1 | RHSA-2026:76448 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.3-0.1.hum1 | RHSA-2026:76430 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 12.4.14-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-12.3 | No fix yet | — |
Advisories 4
- RHSA-2026:76448 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76430 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74164 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-3652 Grafana: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 5, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-81841 vendor-advisory