CVE-2026-27877

EPSS 0.31%
Veröffentlicht 27.03.2026 14:02:11
Zuletzt bearbeitet 30.06.2026 03:17:59
Quelle security@grafana.com
CVE-Watchlists
Login
Unerledigt
Login

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 2 Referenzen 13

NVD 5 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Grafana ≫ Grafana Version < 9.3.0

Grafana ≫ Grafana Version >= 11.6.14 < 12.0.0

Grafana ≫ Grafana Version >= 12.1.10 < 12.2.0

Grafana ≫ Grafana Version >= 12.2.8 < 12.3.0

Grafana ≫ Grafana Version >= 12.3.6 < 12.4.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.31%	0.225

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security@grafana.com	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N