Grafana Labs 10.2.0 < 11.6.9+security-01 / 12.0.0 < 12.0.8+sec...

CVE-2026-21721 is a broken access-control bug in Grafana's dashboard permissions API. The endpoint that manages per-dashboard ACLs checks only that the caller holds the dashboards.permissions:* action — it never validates that the caller is actually authorized *for the specific dashboard being modified*. An authenticated user who legitimately manages permissions on Dashboard A can therefore read and rewrite permissions on Dashboards B through Z. Affected versions span 10.2.0 through 11.6.8, 12.0.0–12.0.7, 12.1.0–12.1.4, 12.2.0–12.2.2, and 12.3.0. Patched releases are 11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01, 12.2.3+security-01, and 12.3.1+security-01.

Grafana and Red Hat both stamp this HIGH / 8.1, but the CVSS score overweights the theoretical ceiling and ignores the prerequisite chain. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N counts PR as Low, yet the *actual* prerequisite is not merely 'any authenticated user' — it's a user who already holds the dashboards.permissions:* action on at least one dashboard. In most orgs that population is dashboard admins and Grafana Org Admins, i.e., a small, already-privileged cohort. The impact is confined to dashboard ACL manipulation within one Grafana organization — not RCE, not data-source credential theft, not system compromise. With no public PoC, no KEV listing, no in-the-wild activity, and an EPSS of 0.67% (49th percentile), the vendor severity is materially inflated.

1. Audit and minimize dashboards.permissions:* grants — Review Grafana RBAC assignments and remove dashboards.permissions:write from any user or service account that does not strictly need it. This directly eliminates the attacker population for this CVE. Complete within the 365-day noisgate remediation SLA window, but start immediately as it's good hygiene regardless.
2. Enable Grafana Enterprise audit logging — If running Grafana Enterprise, enable the audit log and forward dashboards.permissions change events to your SIEM. This provides detection coverage for exploitation attempts until the patch is applied.
3. Restrict Grafana network exposure — Ensure Grafana is not directly internet-facing. Place it behind a reverse proxy with SSO/MFA enforcement. While this CVE requires authentication, reducing the attack surface limits credential-stuffing and token-theft vectors that could feed into this chain.
4. Apply the vendor patch within 365 days — Update to 11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01, 12.2.3+security-01, or 12.3.1+security-01 depending on your release train. As a MEDIUM-severity finding with no mitigation SLA, go straight to the remediation window. RHEL users can apply the relevant RHSA errata (2026:2914, 2026:3078, etc.).

Run this on your Grafana server or any host with curl and network access to the Grafana API. Invoke as: bash check_cve_2026_21721.sh https://grafana.example.com. No authentication required — it queries the unauthenticated /api/health endpoint for version info.

#!/usr/bin/env bash
# check_cve_2026_21721.sh — Detect CVE-2026-21721 (Grafana dashboard permissions scope bypass)
# Usage: bash check_cve_2026_21721.sh <GRAFANA_BASE_URL>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:-}"
if [[ -z "$GRAFANA_URL" ]]; then
  echo "Usage: $0 <GRAFANA_BASE_URL>"
  echo "Example: $0 https://grafana.example.com"
  exit 2
fi

# Strip trailing slash
GRAFANA_URL="${GRAFANA_URL%/}"

# Fetch version from health endpoint
VERSION=$(curl -sk --max-time 10 "${GRAFANA_URL}/api/health" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || true)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not retrieve Grafana version from ${GRAFANA_URL}/api/health"
  exit 2
fi

echo "Detected Grafana version: $VERSION"

# Strip +security-01 or similar suffixes for comparison, but note their presence
HAS_SECURITY_SUFFIX=0
if [[ "$VERSION" == *"+security"* ]]; then
  HAS_SECURITY_SUFFIX=1
fi

# Extract base version (strip everything after +)
BASE_VERSION=$(echo "$VERSION" | sed 's/+.*//')

# Version comparison function
ver() { printf '%03d%03d%03d' $(echo "$1" | tr '.' ' '); }

V=$(ver "$BASE_VERSION")

# Check affected ranges:
# 10.2.0 - 11.6.8 → fixed in 11.6.9+security-01
# 12.0.0 - 12.0.7 → fixed in 12.0.8+security-01
# 12.1.0 - 12.1.4 → fixed in 12.1.5+security-01
# 12.2.0 - 12.2.2 → fixed in 12.2.3+security-01
# 12.3.0          → fixed in 12.3.1+security-01

VULNERABLE=0

if [[ $V -ge $(ver "10.2.0") && $V -le $(ver "11.6.8") ]]; then
  VULNERABLE=1
elif [[ $V -eq $(ver "11.6.9") && $HAS_SECURITY_SUFFIX -eq 0 ]]; then
  # 11.6.9 without +security-01 may still be vulnerable
  VULNERABLE=1
elif [[ $V -ge $(ver "12.0.0") && $V -le $(ver "12.0.7") ]]; then
  VULNERABLE=1
elif [[ $V -eq $(ver "12.0.8") && $HAS_SECURITY_SUFFIX -eq 0 ]]; then
  VULNERABLE=1
elif [[ $V -ge $(ver "12.1.0") && $V -le $(ver "12.1.4") ]]; then
  VULNERABLE=1
elif [[ $V -eq $(ver "12.1.5") && $HAS_SECURITY_SUFFIX -eq 0 ]]; then
  VULNERABLE=1
elif [[ $V -ge $(ver "12.2.0") && $V -le $(ver "12.2.2") ]]; then
  VULNERABLE=1
elif [[ $V -eq $(ver "12.2.3") && $HAS_SECURITY_SUFFIX -eq 0 ]]; then
  VULNERABLE=1
elif [[ $V -eq $(ver "12.3.0") ]]; then
  VULNERABLE=1
fi

if [[ $VULNERABLE -eq 1 ]]; then
  echo "VULNERABLE — Grafana $VERSION is affected by CVE-2026-21721"
  echo "Upgrade to the corresponding +security-01 release for your branch."
  exit 0
else
  echo "PATCHED — Grafana $VERSION is not affected by CVE-2026-21721"
  exit 1
fi

1. Grafana Security Advisory CVE-2026-21721
2. Tenable Plugin 297197
3. Red Hat CVE-2026-21721
4. NVD CVE-2026-21721
5. Snyk — Authorization Bypass in Grafana
6. Grafana Internet Exposure Analysis (ZoomEye)
7. CyberStrike CVE-2026-21721 Detail