CVE-2021-39226 is a high-severity (CVSS 7.3) Improper Authentication vulnerability in github.com/grafana/grafana. It is in CISA's Known Exploited Vulnerabilities catalog (added 2022-08-25) — treat it as actively exploited and patch now. A fix is available for github.com/grafana/grafana — see the affected versions and patch details below.
Authentication bypass for viewing and deletions of snapshots
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2022-08-25. Federal agencies were required to remediate by 2022-09-15.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2021-39226.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2021-39226 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/grafana/grafana🐹github.com/grafana/grafanaReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Today we are releasing Grafana 7.5.11, and 8.1.6. These patch releases include an important security fix for an issue that affects all Grafana versions from 2.0.1.
Grafana Cloud instances have already been patched and an audit did not find any usage of this attack vector. Grafana Enterprise customers were provided with updated binaries under embargo.
8.1.5 contained a single fix for bar chart panels. We believe that users can expedite deployment by moving from 8.1.4 to 8.1.6 directly.
CVE-2021-39226 Snapshot authentication bypass
Summary
CVSS Score: 9.8 Critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
We received a security report to [email protected] on 2021-09-15 about a vulnerability in Grafana regarding the snapshot feature. It was later identified as affecting Grafana versions from 2.0.1 to 8.1.6. CVE-2021-39226 has been assigned to this vulnerability.
Impact
Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:
/dashboard/snapshot/:key, or/api/snapshots/:key
If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:
/api/snapshots-delete/:deleteKey
Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:
/api/snapshots/:key, or/api/snapshots-delete/:deleteKey
The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.
Attack audit
While we can not guarantee that the below will identify all attacks, if you do find something with the below, you should consider doing a full assessment.
Through reverse proxy/load balancer logs
To determine if your Grafana installation has been exploited for this vulnerability, search through your reverse proxy/load balancer access logs for instances where the path is /dashboard/snapshot/:key, /api/snapshots/:key or /api/snapshots-delete/:deleteKey, and the response status code was 200 (OK).
For example, if you’re using the Kubernetes ingress-nginx controller and sending logs to Loki, use a LogQL query like {job="nginx-ingress-controller"} |= "\"status\": 200" |= "\"uri\": \"/api/snapshots/:key\"".
Through the Grafana Enterprise audit feature
If you enabled “Log web requests” in your configuration with router_logging = true, look for
"requestUri":"/api/snapshots-delete/”,“requestUri":"/api/snapshots/:key", or "type":"snapshot" in combination with "action":"delete".
Patched versions
Release 8.1.6:
Release 7.5.11:
Solutions and mitigations
Download and install the appropriate patch for your version of Grafana.
Grafana Cloud instances have already been patched, and Grafana Enterprise customers were provided with updated binaries under embargo.
Workaround
If for some reason you cannot upgrade:
You can use a reverse proxy or similar to block access to the literal paths
/api/snapshots/:key/api/snapshots-delete/:deleteKey/dashboard/snapshot/:key/api/snapshots/:key
They have no normal function and can be disabled without side effects.
Timeline and postmortem
Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.
- 2021-09-15 14:49: Tuan Tran [email protected] sends initial report about viewing snapshots without authentication
- 2021-09-15 15:56: Initial reproduction
- 2021-09-15 17:10: MEDIUM severity declared
- 2021-09-15 18:58: Workaround deployed on Grafana Cloud
- 2021-09-15 19:15:
/api/snapshots/:keyfound to be vulnerable as well - 2021-09-15 19:30:
/api/snapshots/:keyblocked on Grafana Cloud - 2021-09-16 09:31:
/api/snapshots-delete/:deleteKeyfound to be vulnerable as well, blocked on Grafana Cloud. From this point forward, Cloud is not affected any more. - 2021-09-16 09:35: HIGH severity declared
- 2021-09-16 11:19: Realization that combination of deletion and viewing allows enumeration and permanent DoS
- 2021-09-16 11:19: CRITICAL declared
- 2021-09-17 10:53: Determination that no weekend work is needed. While issue is CRITICAL, scope is very limited
- 2021-09-17 14:26: Audit of Grafana Cloud concluded, no evidence of exploitation
- 2021-09-23: Grafana Cloud instances updated
- 2021-09-28 12:00: Grafana Enterprise images released to customers under embargo
- 2021-10-05 17:00: Public release
Reporting security issues
If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs's open source and commercial products (including but not limited to Grafana, Tempo, Loki, Amixr, k6, Tanka, and Grafana Cloud, Grafana Enterprise, and grafana.com). We only accept vulnerability reports at this address. We would prefer that you encrypt your message to us using our PGP key. The key fingerprint is:
F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA
The key is available from keys.gnupg.net by searching for [security@grafana](http://keys.gnupg.net/pks/lookup?search=security@grafana&fingerprint=on&op=index.
Security announcements
We maintain a category on the community site named Security Announcements, where we will post a summary, remediation, and mitigation details for any patch containing security fixes. You can also subscribe to email updates to this category if you have a grafana.com account and sign in to the community site, or via updates from our Security Announcements RSS feed.
Acknowledgement
We would like to thank Tran Viet Tuan for responsibly disclosing the initially discovered vulnerability to us.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/grafana/grafana | all versions | 7.5.11go get github.com/grafana/grafana@v7.5.11 |
| 🐹Go | github.com/grafana/grafana | ≥ 8.0.0&&< 8.1.6 | 8.1.6go get github.com/grafana/grafana@v8.1.6 |
Affected Products
fedorafedoraprojectgrafanagrafanaResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/grafana/grafana to 7.5.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-39226 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
How to detect CVE-2021-39226
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2021-39226 -u https://target- Template
- Grafana Snapshot - Authentication Bypass
- Severity
- high
- Impact
- An attacker can bypass authentication and gain unauthorized access to Grafana Snapshot feature.
- Remediation
- This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Template by ProjectDiscovery nuclei-templates (Evan Rubinstein, matejsmycka), MIT licensed. View the full template. Scan only systems you are authorised to test.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
In OpenShift Container Platform (OCP), Red Hat Advanced Cluster Management for Kubernetes (RHACM), and OpenShift ServiceMesh (OSSM) the grafana components are protected by OpenShift OAuth that reduces the impact of this flaw to Moderate. Access to the grafana panel where snapshots can be created requires admin…
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 8 | grafana-0:7.3.6-3.el8_4 | RHSA-2021:3771 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | grafana-0:6.2.2-7.el8_1 | RHSA-2021:3769 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | grafana-0:6.3.6-3.el8_2 | RHSA-2021:3770 |
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana:v3.11.784-1.g423963f | RHSA-2022:6252 |
| Red Hat OpenShift Container Platform 4.10 | openshift4/ose-grafana:v4.10.0-202202160023.p0.g48aec35.assembly.stream | RHSA-2022:0056 |
| Red Hat OpenShift Container Platform 4.6 | openshift4/ose-grafana:v4.6.0-202208310224.p0.gcf170c0.assembly.stream | RHSA-2022:6262 |
| Red Hat OpenShift Container Platform 4.7 | openshift4/ose-grafana:v4.7.0-202208310205.p0.g613acad.assembly.stream | RHSA-2022:6322 |
| Red Hat OpenShift Container Platform 4.8 | openshift4/ose-grafana:v4.8.0-202208311019.p0.gf98b47f.assembly.stream | RHSA-2022:6308 |
Frequently Asked Questions
Is CVE-2021-39226 in your dependencies?
Find it across Go, including transitive dependencies.