Grafana public dashboards disclose all direct mode datasources

🗓️ 27 Mar 2026 15:30:25Reported by GitHub Advisory DatabaseType

Public Grafana dashboards expose direct data source passwords; convert to proxied sources to improve security.

Reporter	Title	Published	Views	Family All 103
FreeBSD	Grafana -- Public dashboards discloses all direct mode datasources	27 Mar 202600:00	–	freebsd
ATTACKERKB	CVE-2026-27877	27 Mar 202614:02	–	attackerkb
Tenable Nessus	AlmaLinux 10 : grafana (ALSA-2026:10223)	30 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : grafana (ALSA-2026:10226)	30 Apr 202600:00	–	nessus
Tenable Nessus	FreeBSD : Grafana -- Public dashboards discloses all direct mode datasources (6b2bf8e9-5900-11f1-b525-3c7c3fba4204)	27 May 202600:00	–	nessus
Tenable Nessus	Grafana 9.3.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 / 12.3.0 < 12.3.6 / 12.4.0 < 12.4.2 Information Disclosure (CVE-2026-27877)	2 Apr 202600:00	–	nessus
Tenable Nessus	MiracleLinux 9 : grafana-10.2.6-20.el9_7 (AXSA:2026-526:11)	3 May 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	14 Jun 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : grafana (ELSA-2026-10223)	24 Apr 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : grafana (ELSA-2026-10226)	24 Apr 202600:00	–	nessus

Vulners

Node

grafana grafanaRange1.9.2-0.20221116104934-4ee83a5f2bf4–1.9.2-0.20260325055210-3522153e07b4go

grafana grafanaRange12.4.0–12.4.2go

grafana grafanaRange12.3.0–12.3.6go

grafana grafanaRange12.2.0–12.2.8go

grafana grafanaRange12.0.0–12.1.10go

grafana grafanaRange9.3.0–11.6.14go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27877
grafana	www.grafana.com/security/security-advisories/cve-2026-27877
github	www.github.com/advisories/GHSA-3q27-7qjq-p9c5

13 May 2026 13:44Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5 - 7.5

EPSS0.00198

SSVC