VDB
CVE-2026-81841
CVE-2026-81841
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GRAFANA · Published September 29, 2026
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0, 12.0.0, 12.1.0 |
| Grafana | Grafana OSS | 11.6.0, 12.0.0, 12.1.0 |
| alpine | grafana | 0 |
| Grafana | Grafana OSS | 11.6.0, 12.0.0, 12.1.0 |
| Grafana | Grafana Enterprise | 11.6.0, 12.0.0, 12.1.0 |
Timeline
- Sep 29, 2026 CVE Published
- Sep 30, 2026 EPSS Score
- Sep 30, 2026 CVE Updated
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score