CVE-2026-17183

CVE-2026-17183 CVE Record

State: Published
Severity: 7.1 High
Published: Aug 19, 2026
Updated: Aug 27, 2026
Reserved: Jul 24, 2026

Description

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	GRAFANA

Weaknesses

CWE-863 INCORRECT AUTHORIZATION

Affected Products

Product	Versions
Grafana OSSGrafana	8.4.0 to before 12.3.11Affected 12.4.0 to before 12.4.9Affected 13.0.0 to before 13.0.7Affected 13.1.0 to before 13.1.4Affected
Grafana EnterpriseGrafana	8.4.0 to before 12.3.11Affected 12.4.0 to before 12.4.9Affected 13.0.0 to before 13.0.7Affected 13.1.0 to before 13.1.4Affected

References

https://grafana.com/security/security-advisories/cve-2026-17183vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.