Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-21727: Grafana lets other users view and delete data
CVE-2026-21727 · published 11 days ago
Summary
Older versions of Grafana contain a design flaw that can let one tenant see or remove information belonging to another tenant. This could expose confidential dashboards or allow unauthorized changes. Upgrade to the latest Grafana release that includes the fix, and verify that you are running a version newer than the listed affected releases.
What to do
- Update github.com grafana to version 1.9.2-0.20260127141016-e702db6096e0.
- Update grafana to version 12.3.3.
- Update grafana grafana correlations to version 12.4.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:16.04:LTS | canonical | grafana | All versions |
| – | grafana | grafana correlations | < 12.4.0 |
| – | grafana | grafana |
< 11.6.11 >= 12.0.0, < 12.0.9 >= 12.1.0, < 12.1.6 >= 12.2.0, < 12.2.4 >= 12.3.0, < 12.3.3 cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* |
| go | github.com | grafana |
< 1.9.2-0.20260127141016-e702db6096e0 Fix: upgrade to 1.9.2-0.20260127141016-e702db6096e0
|
| Bitnami | – | grafana |
>= 12.3.0, < 12.3.3 Fix: upgrade to 12.3.3
|
| Go | grafana | github.com/grafana/grafana | All versions |
Original advisory text
Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana
Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260127141016-e702db6096e0.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260127141016-e702db6096e0.
References
- https://ubuntu.com/security/CVE-2026-21727 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-21727 Third Party Advisory
- https://grafana.com/security/security-advisories/cve-2026-21727 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21727... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-21727 Vendor Advisory
- https://github.com/grafana/grafana/commit/2b2847625b8a77ba47128ccb5ecbcd72542cb9... Patch
- https://github.com/grafana/grafana/commit/2cf0dd6fde3f5a2b92864e2376ae5378c7df45... Patch
- https://github.com/grafana/grafana/commit/4010ee30bb441bc399a1f37bdc8ab55ec909f3... Patch
- https://github.com/grafana/grafana/commit/8e7ea333991d913298bd68d4787da9c6977a0a... Patch
- https://github.com/grafana/grafana/commit/a9a98fc4327182d1bdb9a74b5c2938d5c127e7... Patch
- https://github.com/grafana/grafana/commit/e702db6096e0509ff2825f732697f077e9e628... Patch
- https://github.com/advisories/GHSA-p5x9-j974-rpfp Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published7 Oct 2026
Updated14 Oct 2026
First seen15 Apr 2026
Sources
CVE-2026-21727 · OSV
CVE-2026-21727 · NVD
CVE-2026-21727 · MITRE
UBUNTU-CVE-2026-21727 · OSV
GHSA-p5x9-j974-rpfp · GHSA
BIT-grafana-2026-21727 · OSV
GO-2026-6664 · OSV
Track software like this
Free during beta