[ CVE-2026-81841 · Published 29 Sep 2026 ]

Vulnerability in Grafana Enterprise

CVSS 5.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund29 Sep 2026WID-SEC-2026-3652

Grafana: Vulnerability allows information disclosure Translated from German
CVE-2026-81841

[ References ]References

grafana.com/security/security-advisories/cve-2026-81841

[ Facts ]Key facts

CVE: CVE-2026-81841
EUVD: EUVD-2026-89456
Published: 29 Sep 2026, 21:19 UTC
Updated: 30 Sep 2026, 17:23 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Scored by security@grafana.com
EPSS: 0.37% chance of exploitation in 30 days · higher than 30% of CVEs
CISA SSVC: Exploitation: none · Automatable: yes · Impact: partial
Weakness: CWE-862

[ Affected ]Affected products

Grafana Grafana Enterprise11.6.0 – ≤ 11.6.17, 12.0.0 – ≤ 12.0.10, 12.1.0 – ≤ 12.1.10, 12.2.0 – ≤ 12.2.11, 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12
Grafana Grafana OSS11.6.0 – ≤ 11.6.17, 12.0.0 – ≤ 12.0.10, 12.1.0 – ≤ 12.1.10, 12.2.0 – ≤ 12.2.11, 12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Vulnerability allows information disclosure Translated from German

[ References ]References