CVE-2022-35957
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
- State
- Published
- Severity
- 6.6 Medium
- Published
- Sep 20, 2022
- Updated
- Jan 28, 2026
- Reserved
- Jul 15, 2022
Description
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H | GitHub_M |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
grafanagrafana |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.