Access Control Flaw in Grafana Dashboard by Grafana Labs
CVE-2026-81841

5.3MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
29 September 2026

What is CVE-2026-81841?

An access control vulnerability exists in Grafana where pausing a shared public dashboard does not revoke its access token for the associated endpoints. This flaw allows any individual with the link to a paused dashboard to access the configuration of the dashboard's data sources, including potentially sensitive credentials, without authentication. While deleting the shared dashboard will revoke the token, the period during which the dashboard is paused poses a security risk to sensitive data.

Affected Version(s)

Grafana Enterprise 11.6.0 <= 11.6.17

Grafana Enterprise 12.0.0 <= 12.0.10

Grafana Enterprise 12.1.0 <= 12.1.10

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

owen050724 (Researcher)
.