Grafana: datasource query caching stores grafana_session headers, leaking user sessions

Impact

With datasource query caching enabled, Grafana caches all request headers including grafana_session. Any user who queries a cached datasource can retrieve another user's session token and act as that user. On a GPU fleet Grafana is usually the shared observability front end for DCGM, fabric and scheduler metrics, and often the same instance serves operators and tenants; a stolen session can escalate from a tenant view to an admin view, and Grafana admin typically means access to datasource credentials for the metrics and logging backends behind it. Impact is confined to the monitoring plane - it does not touch GPU nodes directly - but it is a credible path to operator-level visibility and stored datasource secrets.

Who can reach it

Any authenticated Grafana user who can run a query against a datasource that has query caching enabled.

What to do

Upgrade Grafana to 9.2.10 or 9.3.4 and restart the service - a single daemon restart on the monitoring host, no impact on GPU workloads. If an upgrade cannot be scheduled immediately, disable datasource query caching on all datasources, and rotate Grafana sessions and any datasource credentials that may have been reachable.

References

Related entries

• MinIO: Non-admin user can create service accounts for root/admin users and assume their policiesCVE-2022-24842 · MinIOHigh
• HTCondor (CLAIMTOBE authentication method): Once a user has authenticated to a daemon with CLAIMTOBE - a method thatCVE-2022-26110 · HTCondor (CLAIMTOBE authentication method)High
• Honeywell Alerton Visual Logic, Ascent Control Module (ACM) and Compass 1.6.5: Unauthenticated program writesCVE-2022-30243 · Honeywell Alerton Visual Logic, Ascent Control Module (ACM) and Compass 1.6.5High
• VMware vRealize Operations: low-privileged user can create and read hex dumps, leaking data toward RCECVE-2022-31673 · VMware vRealize Operations (information disclosure via hex dumps)High
• Pure Storage Purity//FA and Purity//FB restricted shell (Python environment variables): A logged-in user manipulatesCVE-2022-32552 · Pure Storage Purity//FA and Purity//FB restricted shell (Python environment variables)High
• Pure Storage Purity//FA and Purity//FB restricted shell (environment variables): A second route out of the restrictedCVE-2022-32553 · Pure Storage Purity//FA and Purity//FB restricted shell (environment variables)High