Vulnerability in Grafana OSS

[ Description ]Official description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund30 Sep 2026WID-SEC-2026-3675

  Grafana: Multiple vulnerabilities Translated from German

  CVE-2026-13720CVE-2026-13719

[ References ]References

• grafana.com/security/security-advisories/cve-2026-13720