Grafana: any role, including Viewer, can create and externally publish dashboard snapshots

Impact

Grafana is the standard dashboard for fleet telemetry - DCGM GPU metrics, fabric counters, node health, often tenant-scoped dashboards. A missing authorization check lets any authenticated principal, including a Viewer or a service account with no permissions, create a dashboard snapshot and publish it externally, or delete existing snapshots. Published snapshots carry the rendered panel data with them, so a low-privilege account can push fleet or tenant telemetry to an externally reachable snapshot URL. Scope is marked changed in the CVSS vector because the data leaves Grafana's access model entirely. Only Grafana OSS and Enterprise 12.4 are affected; earlier releases and Grafana 13 are not.

Who can reach it

Any authenticated Grafana user or service account, including read-only ones, over the network. No elevated role needed. Reachable by anyone who has been handed a Viewer login to a tenant dashboard.

What to do

Upgrade Grafana off 12.4 per the vendor advisory, or move to Grafana 13, which is not affected. A Grafana upgrade is a service restart of the Grafana process, not a node action - dashboards are unavailable only for the restart window. Until then, disabling external snapshot publishing and auditing existing snapshots limits exposure.

References

Related entries

• open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handling: Three related defectsCVE-2026-44944 · open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handlingHigh
• GitLab EE: developer-level user can run a policy test pipeline and read protected CI/CD variablesCVE-2026-79708 · GitLab EE (security policy test pipelines, CI/CD variable scope validation)High
• GitLab EE: crafted project export import overflows the Advanced Search Unicode buffer for RCECVE-2026-88765 · GitLab EE (Advanced Search indexing, Unicode conversion buffer on project import)High
• Renovate: unescaped Gradle distributionUrl gives a repository command execution as the Renovate userCVE-2026-88886 · Renovate self-hosted (Gradle Wrapper manager, distributionUrl)High
• Renovate: unescaped Maven Wrapper distributionType lets a repository run commands in the botCVE-2026-88889 · Renovate self-hosted (Maven Wrapper manager, distributionType)High
• Jenkins Script Security Plugin: @Builder builderStrategy escapes the Groovy sandboxCVE-2026-92126 · Jenkins Script Security Plugin (Groovy sandbox, @Builder annotation)High