Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana process

Impact

A crafted plugin archive chains relative symlink entries to write files outside the plugin directory, including an executable backend binary that Grafana then runs with the privileges of the server process. Archives are extracted before their signature is checked, so a valid signature offers no protection and an operator installing a plausible-looking plugin is enough. Grafana is the fleet observability front end in most GPU datacenters and usually holds datasource credentials for Prometheus, DCGM exporters, Loki and cloud backends - code execution there hands an attacker the monitoring plane and its stored secrets. Grafana Enterprise ships the same extraction code and is equally affected.

Who can reach it

Anyone who can get an operator to install a plugin - from the catalog, from an arbitrary archive via grafana-cli, via GF_INSTALL_PLUGINS, or via preinstall configuration. No Grafana authentication is needed by the attacker; the trigger is the install action itself.

What to do

Upgrade Grafana OSS/Enterprise to the fixed release named in the vendor advisory and restart the Grafana service; no node drain is involved. Until then, do not install plugins from outside a trusted, vetted source, and treat GF_INSTALL_PLUGINS and preinstall lists in your deployment manifests as code paths that need review. Rotate datasource credentials if you suspect an untrusted plugin was ever installed.

References

Related entries

• Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
• NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
• Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller canCVE-2026-33001 · Jenkins controller (.tar/.tar.gz extraction, symlink handling)High
• Apache ActiveMQ: Improper input validation and code injection in the brokerCVE-2026-34197 · Apache ActiveMQHigh
• Supermicro SMASH service (X14DBG-DAP, X14DBI): An attacker with any authorised BMC login escalates through the SMASHCVE-2026-3821 · Supermicro SMASH service (X14DBG-DAP, X14DBI)High
• Ceph RGW: unauthenticated STS token encryption lets any token holder bit-flip themselves to RGW adminCVE-2026-39944 · Ceph RADOS Gateway (STS session token AES-128-CBC handler)High