Vulnerability · Published Aug 19, 2026 · Assigned by GRAFANA
CVE-2026-17183CVE-2026-17183 CVE Record
High 7.1
In plain English
A high-severity incorrect authorization in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | grafana | 10.2.6-28.el10_2.9 | ALSA-2026:89732 |
| AlmaLinux:9 | grafana | 10.2.6-23.el9_8.7 | ALSA-2026:89744 |
| AlmaLinux:10 | grafana-selinux | 10.2.6-28.el10_2.9 | ALSA-2026:89732 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-23.el9_8.7 | ALSA-2026:89744 |
| Alpine:v3.24 | grafana | 12.4.14-r0 | ALPINE-CVE-2026-17183 |
| Rocky Linux:10 | grafana | 0:10.2.6-28.el10_2.9 | RLSA-2026:89732 |
| Rocky Linux:9 | grafana | 0:10.2.6-23.el9_8.7 | RLSA-2026:89744 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana OSS | 8.4.0 – before 12.3.1112.4.0 – before 12.4.913.0.0 – before 13.0.713.1.0 – before 13.1.4 |
| Grafana | Grafana Enterprise | 8.4.0 – before 12.3.1112.4.0 – before 12.4.913.0.0 – before 13.0.713.1.0 – before 13.1.4 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://grafana.com/security/security-advisories/cve-2026-17183 vendor-advisory