CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-17183

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Un usuario autenticado con permiso para crear o editar reglas de alerta puede eludir la autorización de consulta de la fuente de datos al marcar una consulta de regla de alerta como una expresión del lado del servidor mientras hace referencia a un UID de fuente de datos real (autorización incorrecta). Esto puede exponer datos accesibles a través de las credenciales de la fuente de datos configuradas de Grafana a usuarios que carecen de permiso para consultar esa fuente de datos.

Information

Published : 2026-08-19 18:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-17183

Mitre link : CVE-2026-17183

CVE.ORG link : CVE-2026-17183

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-17183", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17183", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:40:28.206524Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "8.4.0", "lessThan": "12.3.11", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.9", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.7", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "8.4.0", "lessThan": "12.3.11", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.9", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.7", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-19T18:16:35.940", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-17183", "source": "security@grafana.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource."}, {"lang": "es", "value": "Un usuario autenticado con permiso para crear o editar reglas de alerta puede eludir la autorizaci\u00f3n de consulta de la fuente de datos al marcar una consulta de regla de alerta como una expresi\u00f3n del lado del servidor mientras hace referencia a un UID de fuente de datos real (autorizaci\u00f3n incorrecta). Esto puede exponer datos accesibles a trav\u00e9s de las credenciales de la fuente de datos configuradas de Grafana a usuarios que carecen de permiso para consultar esa fuente de datos."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security@grafana.com"}