CVE-2025-6197

What it actually does

This is an open redirect flaw in Grafana OSS organization-switching behavior. When multiple organizations exist and a victim is currently in a different organization than the one specified in a crafted URL, the application can be induced to redirect the victim to an attacker-controlled destination. The issue does not directly provide code execution or full account compromise, but it can weaken trust boundaries by making a legitimate Grafana URL act as a phishing, credential-harvesting, or token-delivery redirector. The CVSS score is moderate, but the EPSS score is high and exploit maturity is listed as weaponized, increasing practical risk.

Why it matters to the business

An attacker can abuse a trusted Grafana-related URL to send users to malicious sites, increasing the likelihood of successful phishing, session theft attempts, malware delivery, or social-engineering campaigns. Environments with multiple Grafana organizations are most exposed. Although this is not a direct system takeover vulnerability, it can undermine user trust in internal monitoring links and may lead to credential compromise or incident response costs if combined with phishing. The issue is not currently listed in CISA KEV and is not marked as ransomware-associated, but the high EPSS and weaponized status justify prompt remediation.

How an attack unfolds

An attacker first identifies or assumes a Grafana instance with more than one organization configured. They craft a URL that targets the organization-switching functionality and embeds or causes a redirect to an external attacker-controlled destination. The victim must be authenticated or otherwise using Grafana and must currently be associated with a different organization than the one referenced in the crafted link. When the victim clicks the link, Grafana processes the organization switch and then redirects the browser to the attacker-controlled destination. The attacker can host a convincing fake login page, collect credentials, deliver malware, or chain the redirect into another attack flow. The exploit requires user interaction and specific organization-state conditions, but weaponized exploitation lowers the barrier for phishing campaigns.

How to fix it

Upgrade affected packages to a fixed release. For the provided affected package, update kafka_exporter on MinimOS to version 1.9.0-r3 or later. Where Grafana is deployed directly or through a downstream image/package, ensure the bundled Grafana version includes the upstream fix for CVE-2025-6197. As interim mitigations, restrict access to Grafana to trusted networks or VPNs, reduce unnecessary multi-organization exposure, enforce strong SSO/MFA to reduce phishing impact, and configure reverse proxies or WAF rules to block organization-switching requests that contain absolute external redirect targets or suspicious encoded redirect parameters. Do not rely on user training alone; remove the vulnerable code path through patching.

How to confirm the fix worked

Confirm package inventory shows kafka_exporter (MinimOS) at 1.9.0-r3 or later, or that any directly deployed Grafana build contains the fixed organization-switching behavior. Test with a non-production account in an instance with multiple organizations: crafted organization-switching links should not redirect to untrusted external domains after the fix. Review HTTP responses for organization-switching requests and verify that any Location headers resolve only to expected internal or relative destinations. Validate reverse proxy/WAF controls by sending benign test requests containing absolute redirect targets and confirming they are blocked or normalized. Re-scan container images, OS packages, and appliance firmware to ensure no vulnerable downstream package remains present.

Typical attack path

1. Identify a Grafana deployment or downstream package containing the vulnerable organization-switching behavior.
2. Confirm or infer that the instance has multiple organizations configured.
3. Create a crafted organization-switching URL that results in a redirect to an attacker-controlled external site.
4. Send the trusted-looking Grafana URL to a target through email, chat, ticketing systems, documentation, or another social-engineering channel.
5. Wait for a victim who is in a different organization context to click the link.
6. Grafana performs the organization-switching logic and redirects the victim’s browser to the attacker-controlled destination.
7. Use the destination site for phishing, credential capture, malware delivery, or follow-on social engineering.

How to detect it

Investigate historical web server, reverse proxy, load balancer, Grafana application, SSO/IdP, EDR, email gateway, and secure web gateway logs. Focus on organization-switching endpoints followed by HTTP 30x redirects to domains not owned or approved by the organization. Search for redirect parameters containing full external URLs, protocol-relative URLs, encoded schemes, or unusual destination domains. Correlate suspicious requests with user-agent strings, source IPs, referrers from email/chat systems, and subsequent authentication failures or MFA prompts. In SSO logs, look for users who clicked Grafana links and then authenticated to lookalike domains or reported credential prompts. In proxy logs, look for immediate navigation from a Grafana hostname to newly registered, uncategorized, or suspicious external domains. If exploitation is suspected, preserve relevant HTTP access logs, response headers showing Location values, email artifacts containing the crafted link, and browser history from affected users.

• /org/switch
• /org/switch/
• redirectTo=http://
• redirectTo=https://
• redirectTo=//
• redirectTo=%2F%2F
• redirectTo=%68%74%74%70
• redirectTo=%68%74%74%70%73
• Location: http://
• Location: https://
• HTTP/1.1 302
• HTTP/2 302

What your security team should do

• Prioritize patching because exploit maturity is weaponized and EPSS is high, even though the CVSS score is moderate and the issue is not currently in CISA KEV.
• Upgrade kafka_exporter on MinimOS to 1.9.0-r3 or later and verify any bundled Grafana components are fixed.
• Identify Grafana instances with multiple organizations configured; treat those as the highest-risk exposure group.
• Restrict Grafana access to authenticated internal users over VPN, private networks, or trusted identity-aware access controls where feasible.
• Add proxy, WAF, or SIEM detections for organization-switching requests that include absolute URLs, protocol-relative URLs, or encoded external redirect targets.
• Review recent web, proxy, SSO, and email-security logs for evidence of crafted Grafana links used in phishing campaigns.
• Ensure MFA is enforced for Grafana and linked identity providers to reduce impact if users are redirected to credential-harvesting sites.
• Communicate to users that unexpected Grafana links leading to login pages or external sites should be reported.