critical 9.8

CVE-2021-39226 kev in the critical feed json

Snapshot authentication bypass in grafana

published 2021-10-05 5y ago modified 2026-09-10 last mo. also BIT-grafana-2021-39226 , EUVD-2021-2169 , GHSA-69j6-29vr-p3j9

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-08-25
epss: 99.9%; EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits: 0; none known, plus a Nuclei check

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 3 distros 5 links 1

go github.com/grafana/grafana 7.5.11, 8.1.6
bitnami grafana 7.5.11, 8.1.6
grafana grafana 7.5.11, 8.1.6

red hat suse opensuse rocky linux arch linux

grafana RHEL 8 7.3.6-3.el8_4
grafana RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-loki RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-mssql RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-mysql RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-graphite RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-influxdb RHEL 8.2 EUS 6.3.6-3.el8_2
grafana-opentsdb RHEL 8.2 EUS 6.3.6-3.el8_2

red hat advisories RHSA-2021:3771 RHSA-2021:3770 RHSA-2021:3769

rhnlib Manager Client Tools 12-BETA 5.0.1-24.30.3
grafana Manager Client Tools 12-BETA 9.5.8-4.21.2
mgr-push Manager Client Tools 12-BETA 5.0.1-4.21.4
spacecmd Manager Client Tools 12-BETA 5.0.1-41.42.3
python-hwdata Manager Client Tools 12-BETA 2.3.5-15.12.2
uyuni-common-libs Manager Client Tools 12-BETA 5.0.1-3.33.3
kiwi-desc-saltboot Manager Client Tools 12-BETA 0.1.1687520761.cefb248-4.15.2
system-user-grafana Manager Client Tools 12-BETA 1.0.0-3.7.2

suse advisories SUSE-SU-2024:0191-1 SUSE-SU-2022:3425-1 SUSE-SU-2022:3339-1 SUSE-SU-2022:3338-1 SUSE-SU-2022:2134-1 SUSE-FU-2022:1419-1

grafana openSUSE Tumbleweed 7.5.11-3.1
grafana openSUSE Leap 15.3 7.5.12-3.18.1

opensuse advisories openSUSE-SU-2024:11651-1 openSUSE-SU-2022:0140-1

grafana Rocky Linux 8 7.3.6-3.el8_4

rocky linux advisories RLSA-2021:3771

grafana Arch Linux 8.1.6-1

arch linux advisories AVG-2445

github.com/grafana/grafana@2d456a6 commit

Is CVE-2021-39226 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-39226 updated 2026-08-14 cvss 7.3

grafana: Snapshot authentication bypass

Red Hat OpenShift Service Mesh 1 servicemesh-grafana, servicemesh-grafana-prometheus
affected: no fix planned “Out of support scope”
Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat Ceph Storage 2 grafana Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
affected: no fix available
Red Hat Storage 3 grafana
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) grafana 7.3.6-3.el8_4
fixed: vendor fix RHSA-2021:3771
Red Hat Enterprise Linux AppStream EUS (v. 8.1) grafana 6.2.2-7.el8_1, grafana-loki 6.2.2-7.el8_1, grafana-mssql 6.2.2-7.el8_1, grafana-mysql 6.2.2-7.el8_1, grafana-graphite 6.2.2-7.el8_1, grafana-influxdb 6.2.2-7.el8_1, +7 more
fixed: vendor fix RHSA-2021:3769
Red Hat Enterprise Linux AppStream EUS (v. 8.2) grafana 6.3.6-3.el8_2, grafana-loki 6.3.6-3.el8_2, grafana-mssql 6.3.6-3.el8_2, grafana-mysql 6.3.6-3.el8_2, grafana-graphite 6.3.6-3.el8_2, grafana-influxdb 6.3.6-3.el8_2, +7 more
fixed: vendor fix RHSA-2021:3770
Red Hat OpenShift Container Platform 3.11 openshift3/grafana v3.11.784-1.g423963f
fixed: vendor fix RHSA-2022:6252
Red Hat OpenShift Container Platform 4.6 openshift4/ose-grafana v4.6.0-202208310224.p0.gcf170c0.assembly.stream
fixed: vendor fix RHSA-2022:6262

show 5 more

Red Hat OpenShift Container Platform 4.7 openshift4/ose-grafana v4.7.0-202208310205.p0.g613acad.assembly.stream
fixed: vendor fix RHSA-2022:6322
Red Hat OpenShift Container Platform 4.8 openshift4/ose-grafana v4.8.0-202208311019.p0.gf98b47f.assembly.stream
fixed: vendor fix RHSA-2022:6308
Red Hat OpenShift Container Platform 4.9 openshift4/ose-grafana v4.9.0-202208311003.p0.g3b7bed6.assembly.stream
fixed: vendor fix RHSA-2022:6317
Red Hat OpenShift Container Platform 4.10 openshift4/ose-grafana v4.10.0-202202160023.p0.g48aec35.assembly.stream
fixed: vendor fix RHSA-2022:0056
Red Hat Advanced Cluster Management for Kubernetes 2 grafana Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 3.11 openshift3/apb-tools v3.11.784-1, openshift3/mediawiki v3.11.784-1, openshift3/mysql-apb v3.11.784-1, openshift3/mariadb-apb v3.11.784-1, openshift3/csi-attacher v3.11.784-1, openshift3/ose v3.11.784-1.gc4590b1, +68 more Red Hat OpenShift Container Platform 4.6 redhat/redhat-operator-index v4.6, openshift4/ose-cli v4.6.0-202208241715.p0.gb153f08.assembly.stream, openshift4/ose-pod v4.6.0-202208241715.p0.g618b71d.assembly.stream, openshift4/ose-etcd v4.6.0-202208241715.p0.g81f8d41.assembly.stream, openshift4/ose-tests v4.6.0-202208241715.p0.g5d66591.assembly.stream, openshift4/ose-console v4.6.0-202208241715.p0.g8f11b42.assembly.stream, +121 more Red Hat OpenShift Container Platform 4.7 redhat/redhat-operator-index v4.7, openshift4/ose-cli v4.7.0-202208241754.p0.gc4ebc7a.assembly.stream, openshift4/ose-pod v4.7.0-202208241754.p0.g0e45f63.assembly.stream, openshift4/ose-etcd v4.7.0-202208241754.p0.gd252043.assembly.stream, openshift4/ose-tests v4.7.0-202208310055.p0.g7706ed4.assembly.stream, openshift4/ose-console v4.7.0-202208310055.p0.g330ce5d.assembly.stream, +131 more Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202208241844.p0.g3de49cf.assembly.stream, openshift4/ose-pod v4.8.0-202208241844.p0.g31d53a1.assembly.stream, openshift4/ose-etcd v4.8.0-202208241844.p0.g3cc60d0.assembly.stream, openshift4/ose-tests v4.8.0-202208310055.p0.g2eb8645.assembly.stream, openshift4/ose-console v4.8.0-202208310055.p0.g54ca007.assembly.stream, openshift4/ose-coredns v4.8.0-202208241844.p0.g642b46e.assembly.stream, +137 more

+2 more productsfewer

Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202208241755.p0.gb49c285.assembly.stream, openshift4/ose-pod v4.9.0-202208241755.p0.g9e95cb9.assembly.stream, openshift4/ose-etcd v4.9.0-202208241755.p0.g9b68298.assembly.stream, openshift4/ose-tests v4.9.0-202208310055.p0.g6ec9a5e.assembly.stream, openshift4/ose-console v4.9.0-202208310055.p0.g5e0eea2.assembly.stream, openshift4/ose-coredns v4.9.0-202208241755.p0.g3cb11c0.assembly.stream, +148 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202202160843.p0.gf93da17.assembly.stream, openshift4/ose-pod v4.10.0-202202251728.p0.ge419edf.assembly.stream, openshift4/ose-etcd v4.10.0-202202160023.p0.g7bbf25a.assembly.stream, openshift4/ose-tests v4.10.0-202202221318.p0.gc1d9068.assembly.stream, openshift4/ose-console v4.10.0-202202240423.p0.gb6503ff.assembly.stream, openshift4/ose-coredns v4.10.0-202202160023.p0.g3ec1ee7.assembly.stream, +159 more

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2021-10-05 Published
2022-08-25 Added to CISA KEV
2022-09-15 CISA patch deadline
2025-02-06 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-08-25)
Patch by: 2022-09-15 (4y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Grafana Labs, Grafana
CISA name: Grafana Authentication Bypass Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1485 Data Destruction primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-02-06)

Exploit prediction

99.93% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Nuclei template Grafana Snapshot - Authentication Bypass nuclei detection template
github.com https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H
NVD	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/grafana/grafana	<7.5.11 >=8.0.0, <8.1.6	7.5.11 8.1.6
bitnami	grafana	<7.5.11 >=8.0.0, <8.1.6	7.5.11 8.1.6

Affected products

grafana grafana

Classification

Weakness

CWE-287 Improper Authentication
CWE-862 Missing Authorization

References

github.com /grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269
web, patch
github.com /grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9
web, exploit, mitigation, vendor-advisory, advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/
vendor-advisory, broken-link, web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/
vendor-advisory, broken-link, web
grafana.com /docs/grafana/latest/release-notes/release-notes-7-5-11/
release-notes, article
grafana.com /docs/grafana/latest/release-notes/release-notes-8-1-6/
release-notes, article
openwall.com /lists/oss-security/2021/10/05/4
mailing-list, web, third-party-advisory, advisory
security.netapp.com /advisory/ntap-20211029-0008/
third-party-advisory, advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226
government-resource, web, us-government-resource
nvd.nist.gov /vuln/detail/CVE-2021-39226
advisory, web
github.com /grafana/grafana
package
grafana.com /docs/grafana/latest/release-notes/release-notes-7-5-11
web
grafana.com /docs/grafana/latest/release-notes/release-notes-8-1-6
web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT
web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG
web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT
web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG
web
security.netapp.com /advisory/ntap-20211029-0008
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.