CVE-2026-21721
Fixed in a distro release EPSS <1%CVSS 8.1
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Products: grafana/grafana, grafana/grafana-enterprise, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.12, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Multicluster Global Hub, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 8, Red Hat Enterprise Linux 8
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | grafana | 10.2.6-22.el10_1 |
| AlmaLinux 10 | grafana-selinux | 10.2.6-22.el10_1 |
| AlmaLinux 9 | grafana | 10.2.6-18.el9_7 |
| AlmaLinux 9 | grafana-selinux | 10.2.6-18.el9_7 |
| Chainguard | grafana-11.4 | no fix |
| Chainguard | grafana-11.4 | 11.4.8-r3 |
| Chainguard | grafana-11.5 | 11.5.10-r2 |
| Chainguard | grafana-fips-11.5 | no fix |
| Red Hat Enterprise Linux 10.1 | grafana | 0:10.2.6-22.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-debuginfo | 0:10.2.6-22.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-debugsource | 0:10.2.6-22.el10_1 |
| Red Hat Enterprise Linux 10.1 | grafana-selinux | 0:10.2.6-22.el10_1 |
| Red Hat Enterprise Linux 9 | grafana | 0:10.2.6-18.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-debuginfo | 0:10.2.6-18.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-debugsource | 0:10.2.6-18.el9_7 |
| Red Hat Enterprise Linux 9 | grafana-selinux | 0:10.2.6-18.el9_7 |
| Red Hat Enterprise Linux eus 10.0 | grafana | 0:10.2.6-20.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debuginfo | 0:10.2.6-20.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-debugsource | 0:10.2.6-20.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | grafana-selinux | 0:10.2.6-20.el10_0 |
| Red Hat rhel eus 9.6 | grafana | 0:10.2.6-17.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debuginfo | 0:10.2.6-17.el9_6 |
| Red Hat rhel eus 9.6 | grafana-debugsource | 0:10.2.6-17.el9_6 |
| Red Hat rhel eus 9.6 | grafana-selinux | 0:10.2.6-17.el9_6 |
| Rocky Linux 10 | grafana | 0:10.2.6-22.el10_1 |
| Rocky Linux 9 | grafana | 0:10.2.6-18.el9_7 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-promu | 0.17.0-150000.3.30.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 11.6.11-150200.3.83.1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 1.1.0-150000.1.65.1 |
| SUSE Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 |
| SUSE Manager Client Tools 15 | golang-github-boynux-squid_exporter | 1.13.0-150000.1.12.1 |
| SUSE Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150000.1.26.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.0-150000.3.67.1 |
| SUSE Manager Client Tools 15 | grafana | 11.6.11-150000.1.90.1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 |
| SUSE Manager Client Tools 15 | spacecmd | 5.0.15-150000.3.142.1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.38-150000.1.30.1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 1.1.0-150000.1.65.1 |
| SUSE Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-tools | 0.1.38-150000.1.30.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-lusitaniae-apache_exporter | 1.0.10-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.0-150002.3.8.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.6.14+security01-150002.4.14.1 |
| SUSE Multi Linux Manager Tools SLE-15 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.1.13-150002.3.9.3 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.26-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | prometheus-blackbox_exporter | 0.26.0-150002.3.6.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.26-150002.3.12.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| Wolfi | grafana-11.5 | 11.5.10-r2 |
| openSUSE Leap 15.6 | dracut-saltboot | 1.1.0-150000.1.65.1 |
| openSUSE Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0.4.0-150000.1.21.1 |
| openSUSE Leap 15.6 | golang-github-boynux-squid_exporter | 1.13.0-150000.1.12.1 |
| openSUSE Leap 15.6 | golang-github-lusitaniae-apache_exporter | 1.0.10-150000.1.26.1 |
| openSUSE Leap 15.6 | golang-github-prometheus-promu | 0.17.0-150000.3.30.1 |
| openSUSE Leap 15.6 | grafana | 11.6.11-150200.3.83.1 |
| openSUSE Leap 15.6 | prometheus-blackbox_exporter | 0.26.0-150000.1.30.2 |
| openSUSE Leap 15.6 | spacecmd | 5.0.15-150000.3.142.1 |
| openSUSE Tumbleweed | grafana | 11.6.14+security01-1.1 |