Role-Based Access Control Flaw in Grafana Affecting Loki Data Sources

CVE-2026-9703

What is CVE-2026-9703?

A flaw in the data source proxy of Grafana allows users with only the Viewer role to send various write requests (POST, PUT, DELETE) to the Loki rules API. This vulnerability enables unauthorized creation, modification, and deletion of Loki alerting rules, impacting all users of the associated Loki data source. The issue arises from the lack of proper role-based access control, as changes made by a Viewer affect the entire system rather than just the individual user. Although exploitation requires an authenticated Viewer account on a Grafana instance, the implications of this vulnerability can lead to significant disruptions in alerting and monitoring operations. Grafana's Loki itself remains unaffected and does not require patching.

References