cve.bz

CVE-2026-27877

7.5 highEPSS 0.3%

High (7.5) in grafana grafana. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 1.9.2-0.20260325055210-3522153e07b4.

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs
CWE-312, CWE-201
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=9.3.0no fix published
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=12.0.0no fix published
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=12.2.0no fix published
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=12.3.0no fix published
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=12.4.0no fix published
GHSA-3q27-7qjq-p9c5Gogithub.com/grafana/grafana>=1.9.2-0.20221116104934-4ee83a5f2bf4 <1.9.2-0.20260325055210-3522153e07b41.9.2-0.20260325055210-3522153e07b4
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published
GO-2026-5095Gogithub.com/grafana/grafanaall versionsno fix published

References

Check your stackJSON