Skip to content
Fencer Vulns
critical 9.4

CVE-2023-3128 json

Grafana vulnerable to Authentication Bypass by Spoofing

published 2023-06-22 3 y ago modified 2026-09-08 2 mo ago also BIT-grafana-2023-3128 , EUVD-2023-1845 , GHSA-gxh2-6vvc-rrgp , GHSA-mpv3-g8m3-3fjc

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Grafana is validating Azure AD accounts based on the email claim.

On Azure AD, the profile email field is not unique and can be easily modified.

This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

Patch / fix

  • go github.com/grafana/grafana 8.5.27, 9.2.20, 9.3.16, 9.4.13
  • bitnami grafana 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4
  • Grafana Grafana 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4
  • Grafana Grafana Enterprise 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4
  • ceph ceph storage 7.1 2:18.2.1-194.el8cp
  • ceph ceph storage 7.1 2:18.2.1-194.el9cp
  • thrift ceph storage 7.1 0.13.0-2.el8cp
  • cephadm ceph storage 7.1 2:18.2.1-194.el9cp
  • liboath ceph storage 7.1 2.6.2-3.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-194.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-194.el9cp
  • librgw2 ceph storage 7.1 2:18.2.1-194.el8cp

red hat advisories RHSA-2024:3925RHSA-2023:6420RHSA-2023:6972RHSA-2023:4030

  • grafana SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 10.4.13-150200.3.59.1
  • grafana Manager Client Tools 15 10.4.13-150000.1.66.1
  • spacecmd openSUSE Leap 15.6, Manager Client Tools 15 5.0.11-150000.3.130.1
  • uyuni-tools Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.28-150000.1.16.1
  • dracut-saltboot openSUSE Leap 15.6, Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.1728559936.c16d4fb-150000.1.56.1
  • supportutils-plugin-salt SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +14 more 1.2.3-150000.3.16.1
  • golang-github-prometheus-promu SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.17.0-150000.3.24.1
  • golang-github-prometheus-prometheus Manager Client Tools 15 2.53.3-150000.3.59.1

suse advisories SUSE-SU-2025:0545-1SUSE-SU-2025:0525-1SUSE-SU-2025:0524-1SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2023:2917-1

  • grafana openSUSE Tumbleweed 10.0.1-1.1

opensuse advisories openSUSE-SU-2024:13018-1

  • grafana AlmaLinux 8 9.2.10-7.el8_9.alma.1
  • grafana AlmaLinux 9 9.0.9-3.el9_2.alma

almalinux advisories ALSA-2023:6972ALSA-2023:4030

  • grafana Rocky Linux 9 9.0.9-3.el9_2

rocky linux advisories RLSA-2023:4030

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3128 updated cvss 9.8

grafana: account takeover possible when using Azure AD OAuth

  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: workaround, no fix planned “We recommend disabling Active Directory in the Grafana configuration file until a fix is provided.”
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-194.el8cp, ceph 18.2.1-194.el9cp, cephadm 18.2.1-194.el9cp, librbd1 18.2.1-194.el8cp, librbd1 18.2.1-194.el9cp, librgw2 18.2.1-194.el8cp, +37 more
    fixed: vendor fix “We recommend disabling Active Directory in the Grafana configuration file until a fix is provided.” RHSA-2024:3925
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-7.el8_9
    fixed: vendor fix “We recommend disabling Active Directory in the Grafana configuration file until a fix is provided.” RHSA-2023:6972
  • Red Hat Enterprise Linux AppStream (v. 9) grafana 9.0.9-3.el9_2
    fixed: vendor fix “We recommend disabling Active Directory in the Grafana configuration file until a fix is provided.” RHSA-2023:4030
  • Red Hat Cryostat 2 grafana Red Hat Ceph Storage 3 grafana Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 7.1 Tools liboath 2.6.2-3.el8cp, thrift 0.13.0-2.el8cp, gperftools 2.7-9.el8cp, libunwind 1.3.1-3.el8cp, oath-toolkit 2.6.2-3.el8cp, gperftools-libs 2.7-9.el8cp, +1 more Red Hat OpenShift Container Platform 4 grafana, openshift4/ose-grafana
    +1 more products
    Red Hat Storage 3 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction

4.00% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
GitHub 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
>=9.4.0, <9.4.13
>=9.3.0, <9.3.16
>=9.0.0, <9.2.20
<8.5.27
9.4.13
9.3.16
9.2.20
8.5.27
bitnami grafana
>=6.7.0, <8.5.27
>=9.2.0, <9.2.20
>=9.3.0, <9.3.16
>=9.4.0, <9.4.13
>=9.5.0, <9.5.4
8.5.27
9.2.20
9.3.16
9.4.13
9.5.4

Affected products

  • Grafana Grafana
  • Grafana Grafana Enterprise

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.