PT-2026-78541 · Grafana · Grafana Oss
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Grafana OSS version 13.0.1
Description
An authenticated low-privileged user with permissions to create or edit alert rules in a folder can bypass datasource permission enforcement. By setting the client-controlled
queryType variable to expr while providing the UID of a real datasource, the attacker can execute queries against a datasource for which they lack datasources:query permissions. This occurs because the authorization path treats the query as a server-side expression and skips permission checks, but the evaluator subsequently executes the query using the real datasource identified by datasourceUid and Grafana's configured credentials. This can lead to unauthorized data exposure and potential state-changing queries depending on the datasource backend.Recommendations
For Grafana OSS version 13.0.1:
- Do not exempt queries from datasource authorization based solely on the client-controlled
queryTypevariable. - Resolve the referenced datasource server-side before authorization and apply
datasources:querypermissions whenever the resolved UID represents a real datasource. - Require expression queries to reference only the canonical server-side expression datasource and reject mismatches where
queryTypeisexprbut is paired with a real datasource UID. - Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grafana Oss