Skip to content
Fencer Vulns
critical 9.8

CVE-2022-26148 in the critical feed json

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.

published 2022-03-21 4 y ago modified 2026-09-08 2 mo ago also BIT-grafana-2022-26148 , EUVD-2022-30715

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
52.5%
EPSS 52.5% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Patch / fix

  • bitnami grafana 7.3.5

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-26148 updated cvss 9.8

grafana: An information leak issue was discovered in Grafana through 7.3.4, when integrated with Zabbix

  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, openshift-service-mesh/grafana-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 3 grafana
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel7-operator-metadata Red Hat Advanced Cluster Management for Kubernetes 2 grafana-dashboard-loader, rhacm2/acm-grafana-rhel8, rhacm2/grafana-dashboard-loader-rhel9 Red Hat build of Quarkus grafana Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-177, rhceph/keepalived-rhel9 2.2.4-3, rhceph/snmp-notifier-rhel9 1.2.1-36, rhceph/rhceph-haproxy-rhel9 2.4.17-4, rhceph/rhceph-promtail-rhel9 v2.4.0-5 Red Hat Enterprise Linux 8 grafana, grafana-pcp, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, +9 more Red Hat Enterprise Linux 9 grafana, grafana-pcp, grafana-selinux
    +3 more products
    Red Hat OpenShift Container Platform 3.11 openshift3/grafana Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift4/ose-prometheus-operator Red Hat OpenShift GitOps openshift-gitops-1/gitops-rhel8-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

52.51% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Grafana & Zabbix Integration - Credentials Disclosure nuclei detection template
  • 2k8.org https://2k8.org/post-319.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami grafana
<7.3.5
7.3.5

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.