Vulnerability · Published Jun 2, 2025 · Assigned by GRAFANA
CVE-2025-3454
Medium 5.0
In plain English
A medium-severity security flaw in Grafana from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | grafana | 11.6.1-r0 | ALPINE-CVE-2025-3454 |
| Alpine:v3.23 | grafana | 11.6.1-r0 | ALPINE-CVE-2025-3454 |
| Alpine:v3.24 | grafana | 11.6.1-r0 | ALPINE-CVE-2025-3454 |
| Go | github.com/grafana/grafana | 0.0.0-20250424191517-1f707d16ed5d | GHSA-9j65-rv5x-4vrf |
| Go | github.com/grafana/grafana | no fix listed | GO-2025-3742 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | 11.6.0 – before 11.6.0+security-0111.5.0 – before 11.5.3+security-0111.4.0 – before 11.4.3+security-0111.3.0 – before 11.3.5+security-0111.2.0 – before 11.2.8+security-0110.4.0 – before 10.4.17+security-01 |
| Grafana | Grafana Enterprise | 11.6.0 – before 11.6.0+security-0111.5.0 – before 11.5.3+security-0111.4.0 – before 11.4.3+security-0111.3.0 – before 11.3.5+security-0111.2.0 – before 11.2.8+security-0110.4.0 – before 10.4.17+security-01 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N