Infinity Datasource Plugin for Grafana Vulnerability Exposes Data to Attackers

CVE-2025-8341

What is CVE-2025-8341?

The Infinity datasource plugin for Grafana is designed to facilitate data visualization from multiple endpoints including JSON, CSV, XML, GraphQL, and HTML. However, a configuration flaw allows attackers to bypass restrictions meant to limit data source URLs. By crafting a specially formatted URL, an attacker could gain unauthorized access to sensitive data. This issue has been addressed in version 3.4.1, emphasizing the need for users to update their installations promptly to mitigate risks associated with unauthorized data exposure.

References