Grafana Information Disclosure Vulnerability (CNVD-2021-101998)

Grafana is a set of open source monitoring tools from Grafana Labs that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, etc. An information disclosure vulnerability exists in Grafana Agent versions 0.20.1 and earlier and 0.21.2 and earlier, which stems from inline secrets defined in the program’s metric instance configuration being exposed in plaintext via two endpoints, which can be accessed by an unauthenticated attacker can use this vulnerability to access these endpoints.