CVE-2026-15815

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15815", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-07-15T11:15:50.200Z", "datePublished": "2026-09-17T20:47:01.006Z", "dateUpdated": "2026-09-19T03:56:26.777Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-17T20:47:01.006Z"}, "datePublic": "2026-08-15T11:19:01.400Z", "title": "CVE-2026-15815 CVE Record", "descriptions": [{"lang": "en", "value": "Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\n\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.17"}, {"version": "12.0.0", "status": "affected", "versionType": "semver"}, {"version": "12.1.0", "status": "affected", "versionType": "semver"}, {"version": "12.2.0", "status": "affected", "versionType": "semver"}, {"version": "12.3.0", "status": "affected", "versionType": "semver"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"version": "13.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"version": "13.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.2.1"}]}, {"vendor": "Grafana", "product": "Grafana Enterprise", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.17"}, {"version": "12.0.0", "status": "affected", "versionType": "semver"}, {"version": "12.1.0", "status": "affected", "versionType": "semver"}, {"version": "12.2.0", "status": "affected", "versionType": "semver"}, {"version": "12.3.0", "status": "affected", "versionType": "semver"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"version": "13.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"version": "13.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"version": "13.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "13.2.1"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-59", "cweId": "CWE-59", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "description": "CWE-94", "cweId": "CWE-94", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "description": "CWE-22", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-15815", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "INTERNAL_FINDING"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-15815"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-19T03:56:26.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-18T14:26:40.414348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T14:29:25.351Z"}}], "cna": {"title": "CVE-2026-15815 CVE Record", "source": {"discovery": "INTERNAL_FINDING"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.17"}, {"status": "affected", "version": "12.0.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.1"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.17"}, {"status": "affected", "version": "12.0.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.10"}, {"status": "affected", "version": "13.0.0", "versionType": "semver", "lessThanOrEqual": "13.0.8"}, {"status": "affected", "version": "13.1.0", "versionType": "semver", "lessThanOrEqual": "13.1.5"}, {"status": "affected", "version": "13.2.0", "versionType": "semver", "lessThanOrEqual": "13.2.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-15T11:19:01.400Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-15815", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\n\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-17T20:47:01.006Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15815", "state": "PUBLISHED", "dateUpdated": "2026-09-19T03:56:26.777Z", "dateReserved": "2026-07-15T11:15:50.200Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-09-17T20:47:01.006Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.17", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.17", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.10", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThanOrEqual": "13.0.8", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.1.5", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThanOrEqual": "13.2.1", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\n\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS."}], "id": "CVE-2026-15815", "lastModified": "2026-09-19T04:17:53.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15815", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-09-17T21:17:11.210", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-15815"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-94"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION", "id": "2527474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527474"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS.", "A flaw was found in Grafana. When extracting plugin archives, Grafana did not safely resolve symbolic links. A remote attacker could craft a malicious plugin archive with symbolic links to escape the plugin installation directory. This allows the attacker to write arbitrary files and execute malicious code with the privileges of the Grafana server process, leading to remote code execution."], "mitigation": {"lang": "en:us", "value": "While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability."}, "name": "CVE-2026-15815", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Under investigation", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/grafana", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-30T12:39:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15815\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15815"], "statement": "Important: Grafana's plugin extraction process is vulnerable to symbolic link traversal, enabling an attacker to write arbitrary files and achieve remote code execution with the privileges of the Grafana server. This critical flaw allows malicious code execution even before plugin signature verification, posing a significant risk in Red Hat deployments where Grafana is used.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.17]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.1]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.17]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-09-18T20:30:15.707303+00:00", "title": "Grafana Plugin Archive Symlink Chain Enables Remote Code Execution", "updated": "2026-09-18T23:45:15.932622+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}