CVE-2025-3454

State: Published
Severity: 5.0 Medium
Published: Jun 2, 2025
Updated: Jun 2, 2025
Reserved: Apr 8, 2025

Description

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.

Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.

The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N	GRAFANA

Weaknesses

CWE-285

Affected Products

Product	Versions
GrafanaGrafana	11.6.0 to before 11.6.0+security-01Affected 11.5.0 to before 11.5.3+security-01Affected 11.4.0 to before 11.4.3+security-01Affected 11.3.0 to before 11.3.5+security-01Affected 11.2.0 to before 11.2.8+security-01Affected 10.4.0 to before 10.4.17+security-01Affected
Grafana EnterpriseGrafana	11.6.0 to before 11.6.0+security-01Affected 11.5.0 to before 11.5.3+security-01Affected 11.4.0 to before 11.4.3+security-01Affected 11.3.0 to before 11.3.5+security-01Affected 11.2.0 to before 11.2.8+security-01Affected 10.4.0 to before 10.4.17+security-01Affected

References

https://grafana.com/security/security-advisories/cve-2025-3454/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.