CVE-2026-17183

7.1 Élevée

Publiée le 19/08/2026 à 20:16 · Modifiée le 31/08/2026 à 20:50 · En attente d'analyse NVD · Source : security@grafana.com

Description

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Traduire en français

Produits concernés

Grafana OSS
Grafana Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	security@grafana.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://grafana.com/security/security-advisories/cve-2026-17183

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories