CVE-2025-41116

Incorrect oauth passthrough in Grafana Databricks Datasource

State: Published
Severity: 2.1 Low
Published: Nov 11, 2025
Updated: Nov 19, 2025
Reserved: Apr 16, 2025

Description

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in

the wrong user identifier being used, and information for which the viewer is not authorized being returned.

This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N	GRAFANA

Weaknesses

CWE-653

Affected Products

Product	Versions
Grafana Databricks Datasource PluginGrafana Labs	1.6.0 to before 1.12.1Affected

References

https://grafana.com/security/security-advisories/cve-2025-41116/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.