Log in Start free

Vulnerability · Published Mar 27, 2026 · Assigned by GRAFANA

CVE-2026-27877Public dashboards discloses all direct mode datasources

Medium 6.5

In plain English

A medium-severity security flaw in Grafana from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10grafana10.2.6-24.el10_1ALSA-2026:10223
AlmaLinux:10grafana10.2.6-26.el10_2ALSA-2026:19134
AlmaLinux:9grafana10.2.6-20.el9_7ALSA-2026:10226
AlmaLinux:9grafana10.2.6-22.el9_8ALSA-2026:19352
AlmaLinux:10grafana-selinux10.2.6-26.el10_2ALSA-2026:19134
AlmaLinux:10grafana-selinux10.2.6-24.el10_1ALSA-2026:10223
AlmaLinux:9grafana-selinux10.2.6-20.el9_7ALSA-2026:10226
AlmaLinux:9grafana-selinux10.2.6-22.el9_8ALSA-2026:19352
Alpine:v3.23grafana12.2.8-r0ALPINE-CVE-2026-27877
Alpine:v3.24grafana12.4.3-r0ALPINE-CVE-2026-27877
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Gogithub.com/grafana/grafanano fix listedGHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafanano fix listedGHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafanano fix listedGHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafanano fix listedGHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafanano fix listedGHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafana1.9.2-0.20260325055210-3522153e07b4GHSA-3q27-7qjq-p9c5
Gogithub.com/grafana/grafanano fix listedGO-2026-5095
Rocky Linux:10grafana0:10.2.6-24.el10_1RLSA-2026:10223
Rocky Linux:10grafana0:10.2.6-26.el10_2RLSA-2026:19134
Rocky Linux:9grafana0:10.2.6-22.el9_8RLSA-2026:19352
Rocky Linux:9grafana0:10.2.6-20.el9_7RLSA-2026:10226

Affected products (as reported)

VendorProductVersions
Grafana Grafana 9.3.0 – before 11.6.1412.0.0 – before 12.1.1012.2.0 – before 12.2.812.3.0 – before 12.3.612.4.0 – before 12.4.2

Weakness: CWE-312, CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References