CVE-2026-27877
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 27, 2026
CISA due date
—
The record
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-11.6 | 0 | 0 |
| Chainguard | grafana-12.1 | 0 | 0 |
| Chainguard | grafana-12.2 | 0 | 0 |
| Chainguard | grafana-12.3 | 0 | 0 |
| Wolfi | grafana-11.6 | 0 | 0 |
| Wolfi | grafana-12.1 | 0 | 0 |
| Wolfi | grafana-12.2 | 0 | 0 |
| Wolfi | grafana-12.3 | 0 | 0 |
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.1.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana. Also affects grafana-11.6
- CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana. Also affects grafana-11.6
- CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote… Also affects grafana-11.6
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects grafana-11.6
- CVE-2025-11065 A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing… Also affects grafana-11.6
- CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.6
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects grafana-12.1
- CVE-2026-24001 jsdiff is a JavaScript text differencing implementation. Also affects grafana-12.1