Database/Control plane, storage & DevOps
Grafana Prometheus data source: caller-supplied path reaches any endpoint with the data source's credentials
Impact
Grafana passes the caller's resource path straight to the configured Prometheus server without limiting it to the supported API endpoints. Any user who can query the data source can read responses from other endpoints on that server, authenticated with the data source's credentials. Depending on what the Prometheus server exposes, that can include configuration, targets and other material the user was never meant to see.
Who can reach it
An authenticated user with permission to query the Prometheus data source, over the network. The attack complexity is high (CVSS AC:H).
What to do
Upgrade Grafana to a fixed release listed in the Grafana advisory and restart the Grafana server. The record names no fixed version. Until then, give the Prometheus data source credentials no more access than querying needs, and limit who can query the data source.
References
Related entries
- Prometheus: remote_write follows 3xx redirects with the bearer token attached, leaking cloud credentialsCVE-2026-119566 · Prometheus remote_write client (Azure AD / Google IAM bearer token handling on HTTP redirects)Medium
- Grafana: org admin can delete other organizations' snapshots and recover delete keys from share keysCVE-2026-19197 · Grafana (dashboard snapshot API)Medium
- CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching): Stack-based buffer overflow in BIRD's AS_PATH maskCVE-2026-49943 · CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching)Medium
- Jenkins: agent config update names its own target, letting one agent's configurer take over anotherCVE-2026-84651 · Jenkins controller (REST API and CLI agent configuration update)Medium
- Grafana Azure Monitor data source (resource proxy): A Grafana user who only has query access to an Azure Monitor dataCVE-2026-93294 · Grafana Azure Monitor data source (resource proxy)Medium
- Prometheus (exporter-toolkit): Poisoning the built-in auth cache bypasses basic-auth on exportersCVE-2022-46146 · Prometheus (exporter-toolkit)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.