CVE-2022-23498High· 7.1▾ TwilightGrafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.1%
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafana_session. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
grafana >= 8.3.1, < 9.2.10grafana >= 9.3.0, < 9.3.4grafana = 8.3.0Upgrade past the affected range:
grafana 9.3.4Connected by shared product, vendor, weakness, or advisory.
CVE-2025-12141Medium· 6.5In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Wri…
CVE-2023-0507High· 7.3Grafana is an open-source platform for monitoring and observability
CVE-2022-23552High· 7.3Grafana is an open-source platform for monitoring and observability
CVE-2022-36062High· 7.6Grafana is an open-source platform for monitoring and observability
CVE-2026-13719Medium· 4.3An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint
CVE-2022-39324Medium· 6.7Grafana is an open-source platform for monitoring and observability