Grafana 9.3.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 /...

CVE-2026-27877 is an information disclosure flaw in Grafana's public dashboards feature. When a Grafana instance has public dashboards enabled *and* uses direct (browser) access mode data sources, all direct-mode data-source passwords are exposed to anyone who can reach the public dashboard URL — even if those data sources aren't used by the dashboard itself. Proxied (server-mode) data sources are not affected. The bug spans Grafana 9.3.0 through 11.6.13, 12.0.0 through 12.1.9, 12.2.0 through 12.2.7, 12.3.0 through 12.3.5, and 12.4.0 through 12.4.1. Fixed in 11.6.14, 12.1.10, 12.2.8, 12.3.6, and 12.4.2.

Tenable rates this HIGH at CVSS 7.5, treating it as unauthenticated (PR:N) since public dashboards require no login. Grafana's own advisory rates it MEDIUM at CVSS 6.5 (PR:L). In practice, Tenable's framing is closer to correct on the auth question — public means public — but the severity is inflated because the *direct access mode* prerequisite is a dead feature. Direct/browser mode was deprecated in Grafana 7.4.0 (2021) and removed entirely for Elasticsearch in 9.0 and Prometheus in 9.2. Any Grafana instance in the affected range (≥9.3.0) running these core data sources physically cannot have direct mode active. Only third-party or community plugins with custom direct-mode support remain in scope, which is a vanishingly small population. Tenable's own VPR score of 3.0 (Low) tacitly agrees — the real-world risk doesn't match the CVSS label.

1. Convert all direct-mode data sources to proxy/server mode — This is the most effective mitigation and eliminates the vulnerability entirely. In proxy mode, credentials never leave the Grafana backend and are not included in dashboard API responses. Grafana's provisioning API or UI (Data Sources > Settings > Access: Server) can be used for this change. As a MEDIUM-severity finding, no mitigation SLA applies — go straight to the 365-day remediation window, but this config change is low-effort and can be done immediately.
2. Audit and disable unnecessary public dashboards — Run curl -s -H 'Authorization: Bearer <admin-token>' https://<grafana>/api/dashboards/public-dashboards to list all public dashboards. Disable any that are not actively required. Each disabled public dashboard removes an exposure point for this CVE.
3. Rotate all data-source credentials immediately if you had public dashboards + direct mode — If your instance had both conditions active, treat all direct-mode data-source passwords as compromised. Rotate credentials in the backend data sources and update Grafana's stored credentials. This is a one-time remediation task.
4. Place Grafana behind a reverse proxy with authentication — Even for public dashboards, a reverse proxy (nginx, Cloudflare Access, Pomerium) can add rate limiting, IP allowlisting, and an authentication layer. This prevents casual internet enumeration and limits exposure.
5. Upgrade to a fixed Grafana version within the 365-day noisgate remediation SLA — Apply the vendor patch: 11.6.14, 12.1.10, 12.2.8, 12.3.6, or 12.4.2. RHEL users can apply RHSA-2026:19352 or equivalent. Since this is MEDIUM with no active exploitation, the noisgate remediation SLA gives you up to 365 days, but the fix is a straightforward version bump.

Run this script from any host that can reach the Grafana instance's HTTP API. Usage: bash check_cve_2026_27877.sh https://grafana.example.com. No authentication is required for the version check; admin API token is optional but recommended for the direct-mode data-source audit. The script checks version and optionally inspects data-source access modes.

#!/usr/bin/env bash
# check_cve_2026_27877.sh — CVE-2026-27877 Grafana public dashboard credential leak
# Usage: bash check_cve_2026_27877.sh <GRAFANA_URL> [ADMIN_API_TOKEN]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:?Usage: $0 <GRAFANA_URL> [ADMIN_API_TOKEN]}"
GRAFANA_URL="${GRAFANA_URL%/}"
TOKEN="${2:-}"

# Fetch version from /api/health
HEALTH=$(curl -sf --max-time 10 "${GRAFANA_URL}/api/health" 2>/dev/null) || {
  echo "UNKNOWN — cannot reach ${GRAFANA_URL}/api/health"
  exit 2
}

VERSION=$(echo "$HEALTH" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse Grafana version from health endpoint"
  exit 2
fi

echo "Detected Grafana version: $VERSION"

# Version comparison helper
ver_lt() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

# Check affected ranges
VULN=false
if ver_lt "$VERSION" "11.6.14" && ! ver_lt "$VERSION" "9.3.0"; then
  VULN=true
  FIX="11.6.14"
elif ver_lt "$VERSION" "12.1.10" && ! ver_lt "$VERSION" "12.0.0"; then
  VULN=true
  FIX="12.1.10"
elif ver_lt "$VERSION" "12.2.8" && ! ver_lt "$VERSION" "12.2.0"; then
  VULN=true
  FIX="12.2.8"
elif ver_lt "$VERSION" "12.3.6" && ! ver_lt "$VERSION" "12.3.0"; then
  VULN=true
  FIX="12.3.6"
elif ver_lt "$VERSION" "12.4.2" && ! ver_lt "$VERSION" "12.4.0"; then
  VULN=true
  FIX="12.4.2"
fi

if [[ "$VULN" == "false" ]]; then
  echo "PATCHED — Grafana $VERSION is not in any affected range."
  exit 0
fi

echo "VERSION AFFECTED — $VERSION is vulnerable (fix: >= $FIX)"

# Optional: check for direct-mode datasources (requires admin token)
if [[ -n "$TOKEN" ]]; then
  echo ""
  echo "Checking data-source access modes (requires admin privileges)..."
  DS_JSON=$(curl -sf --max-time 10 -H "Authorization: Bearer ${TOKEN}" "${GRAFANA_URL}/api/datasources" 2>/dev/null) || {
    echo "WARNING — could not query /api/datasources (check token permissions)"
  }
  if [[ -n "${DS_JSON:-}" ]]; then
    DIRECT_COUNT=$(echo "$DS_JSON" | grep -co '"access":"direct"' || echo 0)
    TOTAL_COUNT=$(echo "$DS_JSON" | grep -co '"access":' || echo 0)
    echo "Data sources: $TOTAL_COUNT total, $DIRECT_COUNT using direct/browser mode"
    if [[ "$DIRECT_COUNT" -gt 0 ]]; then
      echo "WARNING — direct-mode data sources found. These are exposed via public dashboards."
    else
      echo "NOTE — no direct-mode data sources found. Exploitability is minimal even without patching."
    fi
  fi
  # Check for public dashboards
  PD_JSON=$(curl -sf --max-time 10 -H "Authorization: Bearer ${TOKEN}" "${GRAFANA_URL}/api/dashboards/public-dashboards" 2>/dev/null) || true
  if [[ -n "${PD_JSON:-}" ]]; then
    PD_COUNT=$(echo "$PD_JSON" | grep -co '"uid":' || echo 0)
    echo "Public dashboards found: $PD_COUNT"
    if [[ "$PD_COUNT" -eq 0 ]]; then
      echo "NOTE — no public dashboards active. Vulnerability is not reachable."
    fi
  fi
else
  echo ""
  echo "TIP: Pass an admin API token as the second argument to check for direct-mode data sources and public dashboards."
fi

echo ""
echo "VULNERABLE — Grafana $VERSION is in the affected range for CVE-2026-27877 (upgrade to >= $FIX)"
exit 1

1. Tenable Plugin 304687
2. Grafana Security Advisory — CVE-2026-27877
3. Red Hat Bugzilla — CVE-2026-27877
4. Grafana Blog — Critical and High Security Fixes (March 2026)
5. Grafana GitHub — Direct Access Mode Deprecation (Issue #62270)
6. NVD — CVE-2026-27877
7. SentinelOne Vulnerability Database — CVE-2026-27877
8. AlmaLinux Errata — ALSA-2026:19352