CVE-2026-12933

{}

{}

{}

{"bugzilla": {"description": "grafana: RECORDED QUERIES REMOTE-WRITE VALIDATION COULD USE DATA SOURCE CREDENTIALS BEFORE CHECKING PERMISSIONS", "id": "2565236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565236"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Grafana. The Recorded Queries remote-write target creation endpoint validates target connections using elevated credentials before verifying whether the caller has permission to access the underlying data source. An authenticated attacker with organization editor privileges can exploit this flaw to send authenticated HTTP requests to arbitrary paths on a connected data source host and infer sensitive information from upstream responses."], "mitigation": {"lang": "en:us", "value": "Disable Recorded Queries until the security update is installed, or restrict Editor access to trusted users and restrict the data source credentials and network access."}, "name": "CVE-2026-12933", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12933\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12933"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires authenticated Organization Editor privileges and is restricted to proprietary Enterprise functionality rather than standard Grafana components. Red Hat products distribute the open source (OSS) release of Grafana, which does not include the Enterprise-specific Recorded Queries capability. Consequently, default and standard Red Hat deployments do not expose the vulnerable endpoint.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "product": "grafana", "vendor": "grafana"}], "created": "2026-11-13T18:30:08.276359+00:00", "updated": "2026-11-13T18:30:08.276401+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}