CVE-2026-17183
Fixed in a distro release EPSS <1%CVSS 7.1
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Products: Grafana OSS, Grafana Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | percona-grafana | no fix |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.10-0.1.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.3-0.7.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.2.hum1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 12.4.10-150200.3.94.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | system-user-grafana | 1.0.0-150200.5.8.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| openSUSE Leap 16.0 | grafana | 12.4.10-bp160.1.1 |
| openSUSE Tumbleweed | grafana | 12.4.10-1.1 |