NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

Grafana account takeover via OAuth vulnerabilityGHSA-mx47-6497-3fv2

HIGH

GHSA-mx47-6497-3fv2 is a high-severity (CVSS 7.1) CWE-863 vulnerability in github.com/grafana/grafana. A fix is available for github.com/grafana/grafana — see the affected versions and patch details below.

Also known asBIT-grafana-2022-31107CVE-2022-31107GO-2024-2852
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-mx47-6497-3fv2.

EPSS Exploitation Probability

via FIRST.org ↗
2.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs87th percentile — riskier than 87% of all scored CVEsHighest risk
0.04%1.20%2.37%3.53%0.7%2.9%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected
🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.

Release v.9.0.3, containing this security fix and other patches:

Release v.8.5.9, containing this security fix and other fixes:

Release v.8.4.10, containing this security fix and other fixes:

Release v.8.3.10, containing this security fix and other fixes:

Grafana account takeover via OAuth vulnerability (CVE-2022-31107)

Summary

On June 27 the HTTPVoid team contacted Grafana Labs to disclose a Grafana account takeover via an OAuth vulnerability.

We believe that this vulnerability is rated at CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

Impact

It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.

Affected versions with HIGH severity

All Grafana >=5.3 versions are affected by this vulnerability.

Solutions and mitigations

All installations after Grafana v5.3 should be upgraded as soon as possible.

As a workaround it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

Timeline

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2022-06-27 19:00 - Research submission of vulnerability report 2022-06-27 20:53 - Issue triaged, confirmed positive, and internal incident raised 2022-06-28 08:42 - Fix PR submitted and reviewed 2022-06-28 20:58 - All Grafana Cloud hosted Grafana instances patched 2022-07-05 07:14 - Customers informed under embargo 2022-07-14 02:00 - Public release

Acknowledgement

We would like to thank the HTTPVoid team for responsibly disclosing the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/grafana/grafana≥ 5.3.0-beta1&&< 8.3.108.3.10go get github.com/grafana/grafana@v8.3.10
🐹Gogithub.com/grafana/grafana≥ 8.4.0&&< 8.4.108.4.10go get github.com/grafana/grafana@v8.4.10
🐹Gogithub.com/grafana/grafana≥ 8.5.0&&< 8.5.98.5.9go get github.com/grafana/grafana@v8.5.9
🐹Gogithub.com/grafana/grafana≥ 9.0.0&&< 9.0.39.0.3go get github.com/grafana/grafana@v9.0.3

Affected Products

2 products · 5 configurations
Application
grafanagrafana
≥ 9.0.0 && < 9.0.3
range
Application
e-series performance analyzernetapp
all

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/grafana/grafana to 8.3.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mx47-6497-3fv2 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
Workaround published by Red Hat
As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
Source: Red Hat security advisory for GHSA-mx47-6497-3fv2 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ceph Storage 6.1rhceph/rhceph-6-dashboard-rhel9:6-75RHSA-2023:3642
Red Hat Enterprise Linux 8grafana-0:7.5.11-3.el8_6RHSA-2022:5717
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutionsgrafana-0:6.2.2-9.el8_1RHSA-2022:5720
Red Hat Enterprise Linux 8.2 Extended Update Supportgrafana-0:6.3.6-5.el8_2RHSA-2022:5719
Red Hat Enterprise Linux 8.4 Extended Update Supportgrafana-0:7.3.6-5.el8_4RHSA-2022:5718
Red Hat Enterprise Linux 9grafana-0:7.5.11-5.el9_0RHSA-2022:5716

Frequently Asked Questions

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana. Release v.9.0.3, containing this security fix and other patches: - [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3) - [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/) Release v.8.5.9, containing this security fix and other fixes: - [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9) - [Release notes](https://grafana.com/docs/grafana/next/release-n
O3 Security · Impact-Aware SCA

Is GHSA-mx47-6497-3fv2 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Grafana account takeover via OAuth vulnerability (High 7.1)