CVE-2025-3454
Fixed in a distro release EPSS <1%CVSS 5.0
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.
Products: grafana, Grafana Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 0.0.0-20250424191517-1f707d16ed5d |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | grafana | 11.5.5-150200.3.72.2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 11.5.5-150200.3.72.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.26.0-1.31.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.53.4-1.60.2 |
| SUSE Manager Client Tools 12 | grafana | 11.5.5-1.79.2 |
| SUSE Manager Client Tools 12 | prometheus-blackbox_exporter | 0.26.0-1.27.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.53.4-150000.3.62.2 |
| SUSE Manager Client Tools 15 | grafana | 11.5.5-150000.1.79.1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.15.2-150400.3.133.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| openSUSE Leap 15.6 | grafana | 11.5.5-150200.3.72.2 |
| openSUSE Leap 15.6 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250612T141001-1.1 |
| openSUSE Tumbleweed | grafana | 11.5.4-1.1 |