Grafana Labs Incorrect Permission

CVE-2024-8118 is an RBAC permission check error in Grafana's alerting subsystem affecting versions 8.5.0 through 11.2.0 (fixed in 11.2.1, 11.1.6, 11.0.5, 10.4.9, 10.3.10). The /api/ruler/{DatasourceUID}/api/v1/rules/{Namespace} endpoint — which manages alerting and recording rules stored in external datasources — was documented to enforce alert.rules.external:write but actually checked for alert.instances.external:write. An authenticated user who already held instance-write permission on external datasources could therefore create, edit, and delete alert *rules* on those same datasources without explicit authorization. Impact is limited to alert rule manipulation and potential data leakage from datasource queries routed through crafted notification channels.

Grafana's vendor rating of MEDIUM (5.1 CVSS v4) slightly overstates the real-world risk. The CVSS vector already encodes PR:H (high privileges required) and VC/VI/VA all at Low, which is accurate — but it doesn't capture how narrow the permission gap actually is. The attacker must already hold alert.instances.external:write, a non-trivial RBAC grant that few users receive. The delta between 'can write alert instances' and 'can write alert rules' on external datasources is a marginal privilege escalation within a single application subsystem, not a path to infrastructure compromise. With no public PoC, no exploitation in the wild, no KEV listing, and an EPSS at the 46th percentile, this reads as a compliance fix rather than an urgent threat.

1. Audit and restrict alert.instances.external:write grants — Review Grafana RBAC role assignments and ensure alert.instances.external:write is granted only to users who also legitimately need alert.rules.external:write. In most orgs, these should be the same people, which effectively neutralizes the bug. Complete this audit as part of normal backlog hygiene — no noisgate mitigation SLA applies for LOW severity.
2. Enable and monitor Grafana audit logging — Ensure Grafana's audit log is enabled and forwarded to your SIEM. Monitor for unexpected API calls to /api/ruler/*/api/v1/rules/* by non-admin accounts. This provides detection-in-depth regardless of patch status.
3. Restrict network access to the Grafana API — If Grafana is internet-facing, place the /api/ruler/ path behind authentication enforcement and IP allowlisting at your reverse proxy or WAF layer. This is good hygiene independent of this CVE.
4. Upgrade to a fixed Grafana version during next maintenance window — Apply the vendor patch (11.2.1+, 11.1.6+, 11.0.5+, 10.4.9+, 10.3.10+) within the noisgate remediation SLA of 365 days for LOW severity. No accelerated timeline is warranted given the absence of exploitation activity.

Run this script on the Grafana server host (or any machine with network access to the Grafana API) as any user. It queries the Grafana health endpoint to determine the running version. Example: bash check_cve_2024_8118.sh https://grafana.internal:3000. No authentication required for the health endpoint.

#!/usr/bin/env bash
# check_cve_2024_8118.sh — Detect Grafana versions vulnerable to CVE-2024-8118
# Usage: bash check_cve_2024_8118.sh <GRAFANA_BASE_URL>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:-http://localhost:3000}"

VERSION=$(curl -sf "${GRAFANA_URL}/api/health" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not retrieve Grafana version from ${GRAFANA_URL}/api/health"
  exit 2
fi

echo "Detected Grafana version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$VERSION" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')"

if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
  echo "UNKNOWN — could not parse version string: $VERSION"
  exit 2
fi

# Vuln introduced in 8.5.0. Not affected below 8.5.0.
if [ "$MAJOR" -lt 8 ] || ([ "$MAJOR" -eq 8 ] && [ "$MINOR" -lt 5 ]); then
  echo "PATCHED — version $VERSION is below the affected range (8.5.0+)"
  exit 0
fi

# Fixed versions: 10.3.10, 10.4.9, 11.0.5, 11.1.6, 11.2.1
# Anything >= 11.3.0 is fixed (post-fix release train)
if [ "$MAJOR" -ge 12 ]; then
  echo "PATCHED — version $VERSION is above all affected ranges"
  exit 0
fi

if [ "$MAJOR" -eq 11 ]; then
  if [ "$MINOR" -ge 3 ]; then
    echo "PATCHED — $VERSION"; exit 0
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -ge 1 ]; then
    echo "PATCHED — $VERSION (fixed in 11.2.1)"; exit 0
  elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 6 ]; then
    echo "PATCHED — $VERSION (fixed in 11.1.6)"; exit 0
  elif [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 5 ]; then
    echo "PATCHED — $VERSION (fixed in 11.0.5)"; exit 0
  else
    echo "VULNERABLE — $VERSION is in the affected range for CVE-2024-8118"; exit 1
  fi
fi

if [ "$MAJOR" -eq 10 ]; then
  if [ "$MINOR" -ge 5 ]; then
    echo "PATCHED — $VERSION is above affected 10.x ranges"; exit 0
  elif [ "$MINOR" -eq 4 ] && [ "$PATCH" -ge 9 ]; then
    echo "PATCHED — $VERSION (fixed in 10.4.9)"; exit 0
  elif [ "$MINOR" -eq 3 ] && [ "$PATCH" -ge 10 ]; then
    echo "PATCHED — $VERSION (fixed in 10.3.10)"; exit 0
  elif [ "$MINOR" -ge 3 ]; then
    echo "VULNERABLE — $VERSION is in the affected range for CVE-2024-8118"; exit 1
  else
    # 10.0-10.2 — these are between 8.5 and 10.3, so affected
    echo "VULNERABLE — $VERSION is in the affected range for CVE-2024-8118"; exit 1
  fi
fi

# Major 8 (>=8.5) or 9 — all affected, no backport fixes
if [ "$MAJOR" -eq 9 ] || ([ "$MAJOR" -eq 8 ] && [ "$MINOR" -ge 5 ]); then
  echo "VULNERABLE — $VERSION is in the affected range (8.5.0–9.x) with no fix available for this branch. Upgrade to 10.3.10+ or 11.x."
  exit 1
fi

echo "UNKNOWN — could not determine vulnerability status for $VERSION"
exit 2

1. Grafana Security Advisory — CVE-2024-8118
2. Grafana Security Advisories — CVE-2024-8118 Detail
3. NVD — CVE-2024-8118
4. GitHub Advisory — GHSA-3j8x-8x9q-3m4r
5. Red Hat CVE Entry — CVE-2024-8118
6. FIRST.org EPSS API — CVE-2024-8118
7. Tenable Plugin 208027