Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-81841

Paused shared dashboard access tokens still expose data source configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana Enterprise

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.17affected
  • 12.0.0 to ≤ 12.0.10affected
  • 12.1.0 to ≤ 12.1.10affected
  • 12.2.0 to ≤ 12.2.11affected
  • 12.3.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.12affected
  • 13.0.0 to < 13.0.10affected
  • 13.1.0 to < 13.1.7affected
  • 13.2.0 to < 13.2.3affected

Grafana Grafana OSS

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.17affected
  • 12.0.0 to ≤ 12.0.10affected
  • 12.1.0 to ≤ 12.1.10affected
  • 12.2.0 to ≤ 12.2.11affected
  • 12.3.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.12affected
  • 13.0.0 to < 13.0.10affected
  • 13.1.0 to < 13.1.7affected
  • 13.2.0 to < 13.2.3affected

References