CVE-2026-21722

5.3 mediumEPSS 0.4%

Medium (5.3) in grafana grafana. EPSS 0.4% chance of exploitation in the next 30 days.

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-863
Published: 2026-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grafana:grafana

References

https://grafana.com/security/security-advisories/cve-2026-21722

Check your stack JSON