CVE-2026-27877

Public dashboards discloses all direct mode datasources

State: Published
Severity: 6.5 Medium
Published: Mar 27, 2026
Updated: Aug 27, 2026
Reserved: Feb 24, 2026

Description

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	GRAFANA
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat-SADP

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information
CWE-201 Insertion of Sensitive Information Into Sent Data

Affected Products

Product	Versions
GrafanaGrafana	9.3.0 to before 11.6.14Affected 12.0.0 to before 12.1.10Affected 12.2.0 to before 12.2.8Affected 12.3.0 to before 12.3.6Affected 12.4.0 to before 12.4.2Affected

References

https://grafana.com/security/security-advisories/cve-2026-27877vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-27877vdb-entry
RHBZ#2452293issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27877.json
https://access.redhat.com/errata/RHSA-2026:11417vendor-advisory
https://access.redhat.com/errata/RHSA-2026:10223vendor-advisory
https://access.redhat.com/errata/RHSA-2026:19134vendor-advisory
https://access.redhat.com/errata/RHSA-2026:11416vendor-advisory
https://access.redhat.com/errata/RHSA-2026:10226vendor-advisory
https://access.redhat.com/errata/RHSA-2026:19352vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.