{"cve":"CVE-2022-31130","nvd":{"published":"2022-10-13T23:15:09.637","modified":"2026-06-17T04:44:52.080","status":"Modified","description":"Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-522","CWE-200"],"references":["https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177","https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f","https://github.com/grafana/grafana/releases/tag/v9.1.8","https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc","https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177"],"products":["grafana:grafana"],"source":"nvd","synced_at":"2026-10-19T21:36:05.460296998+00:00"},"epss":{"cve":"CVE-2022-31130","score":0.01334,"percentile":0.71152,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-jv32-5578-pxjc","url":"https://osv.dev/vulnerability/GHSA-jv32-5578-pxjc","summary":"Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins","modified":"2026-09-10T03:50:13.980632603Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=9.0.0 <9.1.8"],"fixed":["9.1.8"]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=7.0.0 <8.5.14"],"fixed":["8.5.14"]}]},{"id":"GO-2024-2851","url":"https://osv.dev/vulnerability/GO-2024-2851","summary":"Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana","modified":"2026-02-04T03:26:38.369571Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}