Information Exposure in Grafana Databricks Datasource Plugin from Grafana

CVE-2025-41116

What is CVE-2025-41116?

The Grafana Databricks Datasource Plugin has a vulnerability that arises when OAuth passthrough is enabled. In a scenario where multiple users utilize the same data source simultaneously on a single Grafana instance, it may inadvertently return data intended for one user to another. This occurs due to the incorrect user identifier being applied, leading to unauthorized access to sensitive information.

References