---
id: CVE-2022-23498
title: Grafana is an open-source platform for monitoring and observability
summary: >-
  Grafana is an open-source platform for monitoring and observability. When
  datasource query caching is enabled, Grafana caches all headers, including
  `grafana_session`. As a result, any user that queries a datasource where the
  caching is …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-200
vendor: grafana
product: grafana
affected:
  - 'grafana >= 8.3.1, < 9.2.10'
  - 'grafana >= 9.3.0, < 9.3.4'
  - grafana = 8.3.0
patched:
  - grafana 9.3.4
published: '2023-02-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:09.223'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23498'
references:
  - url: 'https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8'
    label: security-advisories@github.com
  - url: 'https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230309-0007/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-28T04:55:21.898600Z'
epss: 0.01132
epssPercentile: 0.66533
ingestedAt: '2026-11-05T06:38:03.559Z'
---

## Overview

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.


## Affected

- `grafana >= 8.3.1, < 9.2.10`
- `grafana >= 9.3.0, < 9.3.4`
- `grafana = 8.3.0`

## Remediation

Upgrade past the affected range:

- `grafana 9.3.4`