high 7.5

CVE-2026-27877 json

Public dashboards discloses all direct mode datasources

published 2026-03-27 7 mo ago modified 2026-09-10 1 mo ago also BIT-grafana-2026-27877 , EUVD-2026-16596 , GHSA-3q27-7qjq-p9c5 , GO-2026-5095

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Patch / fix

fixed in 7 distros 6

go github.com/grafana/grafana 1.9.2-0.20260325055210-3522153e07b4
bitnami grafana 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2
Grafana Grafana 11.6.14, 12.1.10, 12.2.8, 12.3.6, 12.4.2
Red Hat Red Hat Enterprise Linux 10 0:10.2.6-24.el10_1, 0:10.2.6-26.el10_2
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:10.2.6-23.el10_0
Red Hat Red Hat Enterprise Linux 9 0:10.2.6-20.el9_7, 0:10.2.6-22.el9_8
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:10.2.6-20.el9_6

red hat suse opensuse almalinux rocky linux alpine

grafana RHEL 9 10.2.6-22.el9_8
grafana-selinux RHEL 9 10.2.6-22.el9_8
grafana RHEL 10.2 10.2.6-26.el10_2
grafana-selinux RHEL 10.2 10.2.6-26.el10_2
grafana RHEL 10.1 10.2.6-24.el10_1
grafana-selinux RHEL 10.1 10.2.6-24.el10_1
grafana RHEL 9 10.2.6-20.el9_7
grafana-selinux RHEL 9 10.2.6-20.el9_7

red hat advisories RHSA-2026:19352 RHSA-2026:19134 RHSA-2026:11416 RHSA-2026:11417 RHSA-2026:10223 RHSA-2026:10226

grafana Multi Linux Manager Tools SLE-15 11.6.14+security01-150002.4.14.1
spacecmd Multi Linux Manager Tools SLE-15 5.1.13-150002.3.9.3
uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.1.26-150002.3.12.1
prometheus-blackbox_exporter Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 0.26.0-150002.3.6.1
golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.5.0-150002.3.8.1
golang-github-lusitaniae-apache_exporter Multi Linux Manager Tools SLE-15 1.0.10-150002.3.6.1

suse advisories SUSE-SU-2026:1524-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
grafana openSUSE Leap 16.0 11.6.14+security04-bp160.1.1
grafana openSUSE Tumbleweed 11.6.14+security01-1.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2026:20940-1 openSUSE-SU-2026:10601-1

grafana AlmaLinux 10 10.2.6-26.el10_2
grafana-selinux AlmaLinux 10 10.2.6-26.el10_2
grafana AlmaLinux 9 10.2.6-22.el9_8
grafana-selinux AlmaLinux 9 10.2.6-22.el9_8
grafana AlmaLinux 10 10.2.6-24.el10_1
grafana-selinux AlmaLinux 10 10.2.6-24.el10_1
grafana AlmaLinux 9 10.2.6-20.el9_7
grafana-selinux AlmaLinux 9 10.2.6-20.el9_7

almalinux advisories ALSA-2026:19134 ALSA-2026:19352 ALSA-2026:10223 ALSA-2026:10226

grafana Rocky Linux 10 10.2.6-26.el10_2
grafana Rocky Linux 9 10.2.6-22.el9_8
grafana Rocky Linux 10 10.2.6-24.el10_1
grafana Rocky Linux 9 10.2.6-20.el9_7

rocky linux advisories RLSA-2026:19134 RLSA-2026:19352 RLSA-2026:10223 RLSA-2026:10226

grafana Alpine 3.23 12.2.8-r0
grafana Alpine 3.24 12.4.3-r0

alpine advisories ALPINE-CVE-2026-27877

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27877 updated 2026-11-04 cvss 7.5

grafana: Grafana: Information disclosure of data-source passwords via public dashboards

Red Hat Enterprise Linux AppStream (v. 9) grafana 10.2.6-20.el9_7, grafana 10.2.6-22.el9_8, grafana-selinux 10.2.6-20.el9_7, grafana-selinux 10.2.6-22.el9_8
fixed: vendor fix RHSA-2026:10226
Red Hat Enterprise Linux AppStream (v. 10) grafana 10.2.6-24.el10_1, grafana 10.2.6-26.el10_2, grafana-selinux 10.2.6-24.el10_1, grafana-selinux 10.2.6-26.el10_2
fixed: vendor fix RHSA-2026:10223
Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana 10.2.6-23.el10_0, grafana-selinux 10.2.6-23.el10_0
fixed: vendor fix RHSA-2026:11417
Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana 10.2.6-20.el9_6, grafana-selinux 10.2.6-20.el9_6
fixed: vendor fix RHSA-2026:11416
Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-03-27)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/grafana/grafana	>=9.3.0 >=12.0.0 >=12.2.0 >=12.3.0 >=12.4.0 >=1.9.2-0.20221116104934-4ee83a5f2bf4, <1.9.2-0.20260325055210-3522153e07b4 all versions	1.9.2-0.20260325055210-3522153e07b4
bitnami	grafana	>=9.3.0, <11.6.14 >=12.0.0, <12.1.10 >=12.2.0, <12.2.8 >=12.3.0, <12.3.6 >=12.4.0, <12.4.2	11.6.14 12.1.10 12.2.8 12.3.6 12.4.2

Affected products

Grafana Grafana
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat Red Hat Enterprise Linux 8

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information
CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

grafana.com /security/security-advisories/cve-2026-27877
vendor-advisory, broken-link, web, advisory
access.redhat.com /errata/RHSA-2026:11417
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:10223
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:19134
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:11416
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:10226
vendor-advisory, web
access.redhat.com /errata/RHSA-2026:19352
vendor-advisory, web
access.redhat.com /security/cve/CVE-2026-27877
vdb-entry, web
bugzilla.redhat.com /show_bug.cgi?id=2452293
issue-tracking, web
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-27877.json
web
nvd.nist.gov /vuln/detail/CVE-2026-27877
advisory, web
github.com /grafana/grafana
package
github.com /advisories/GHSA-3q27-7qjq-p9c5
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: NVD has incorrect affected ranges. They incorrectly interpreted the fixed ranges as affected ranges.

Summary