CVE-2026-21727

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 11.6.11, 12.0.9, 12.1.6, and 12.2.4

Description A cross-tenant isolation issue exists in the Correlations feature affecting legacy correlation records. A backward compatibility condition allows records where org id = 0 to be returned across different organizations. Consequently, a user with datasource management privileges can read and permanently delete legacy correlation data belonging to another organization.

Recommendations Update to version 11.6.11 or later. Update to version 12.0.9 or later. Update to version 12.1.6 or later. Update to version 12.2.4 or later.