GHSA-3q27-7qjq-p9c5MediumCVSS 6.5

Grafana public dashboards disclose all direct mode datasources

Published
March 27, 2026
Last Modified
May 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-27877 →

📋 Description

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

🎯 Affected products6

  • go/github.com/grafana/grafana:>= 9.3.0, < 11.6.14
  • go/github.com/grafana/grafana:>= 12.0.0, < 12.1.10
  • go/github.com/grafana/grafana:>= 12.2.0, < 12.2.8
  • go/github.com/grafana/grafana:>= 12.3.0, < 12.3.6
  • go/github.com/grafana/grafana:>= 12.4.0, < 12.4.2
  • go/github.com/grafana/grafana:>= 1.9.2-0.20221116104934-4ee83a5f2bf4, < 1.9.2-0.20260325055210-3522153e07b4

🔗 References (3)