CVE-2021-39226
Summary
| CVE | CVE-2021-39226 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-10-05 18:15:00 UTC |
| Updated | 2023-11-07 03:37:00 UTC |
| Description | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects. |
Risk And Classification
EPSS: 0.943500000 probability, percentile 0.999580000 (date 2026-04-02)
CISA KEV: Listed on 2022-08-25; due 2022-09-15; ransomware use Unknown
Problem Types: CWE-287
CISA Known Exploited Vulnerability
| Vendor | Grafana Labs |
|---|---|
| Product | Grafana |
| Name | Grafana Authentication Bypass Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/; https://nvd.nist.gov/vuln/detail/CVE-2021-39226 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 34 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Application | Grafana | Grafana | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Fix static path matching issue in macaron · grafana/grafana@2d456a6 · GitHub | MISC | github.com | |
| [SECURITY] Fedora 34 Update: grafana-7.5.11-1.fc34 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| 404 Page not found | Grafana Labs | MISC | grafana.com | |
| [SECURITY] Fedora 34 Update: grafana-7.5.11-1.fc34 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| 404 Page not found | Grafana Labs | MISC | grafana.com | |
| Snapshot authentication bypass · Advisory · grafana/grafana · GitHub | CONFIRM | github.com | |
| oss-security - CVE-2021-39226 Grafana snapshot authentication bypass | MLIST | www.openwall.com | |
| [SECURITY] Fedora 35 Update: grafana-7.5.11-1.fc35 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: grafana-7.5.11-1.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| CVE-2021-39226 Grafana Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159413 Oracle Enterprise Linux Security Update for grafana (ELSA-2021-3771)
- 239695 Red Hat Update for grafana (RHSA-2021:3770)
- 239696 Red Hat Update for grafana (RHSA-2021:3769)
- 239724 Red Hat Update for grafana (RHSA-2021:3771)
- 281995 Fedora Security Update for grafana (FEDORA-2021-dd83dc8b0b)
- 376934 Alibaba Cloud Linux Security Update for grafana (ALINUX3-SA-2021:0073)
- 690217 Free Berkeley Software Distribution (FreeBSD) Security Update for grafana (757ee63b-269a-11ec-a616-6c3be5272acd)
- 730238 Grafana Enterprise Snapshot Authentication Bypass Vulnerability
- 751629 OpenSUSE Security Update for grafana (openSUSE-SU-2022:0140-1)
- 752251 SUSE Enterprise Linux Security Update for SUSE Manager Client Tools (SUSE-SU-2022:2134-1)
- 940331 AlmaLinux Security Update for grafana (ALSA-2021:3771)
- 960005 Rocky Linux Security Update for grafana (RLSA-2021:3771)
- 980094 Go (go) Security Update for github.com/grafana/grafana (GHSA-69j6-29vr-p3j9)