CVE-2026-21722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21722", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-01-05T09:26:06.214Z", "datePublished": "2026-02-12T08:49:05.678Z", "dateUpdated": "2026-08-27T17:22:42.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:42.160Z"}, "datePublic": "2026-02-12T07:13:06.000Z", "title": "Public Dashboards time range restriction on annotations can be bypassed", "descriptions": [{"lang": "en", "value": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard."}], "affected": [{"vendor": "Grafana", "product": "grafana/grafana", "defaultStatus": "unaffected", "versions": [{"status": "affected", "versionType": "semver", "version": "9.3.0", "lessThan": "11.6.10+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.0.0", "lessThan": "12.1.6+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.2.0", "lessThan": "12.2.4+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.3.0", "lessThan": "12.3.2+security-01"}]}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "defaultStatus": "unaffected", "versions": [{"status": "affected", "versionType": "semver", "version": "9.3.0", "lessThan": "11.6.10+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.0.0", "lessThan": "12.1.6+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.2.0", "lessThan": "12.2.4+security-01"}, {"status": "affected", "versionType": "semver", "version": "12.3.0", "lessThan": "12.3.2+security-01"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21722", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T14:24:06.337064Z", "id": "CVE-2026-21722", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T14:01:13.177Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T14:24:06.337064Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:24:11.898Z"}}], "cna": {"title": "Public Dashboards time range restriction on annotations can be bypassed", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "Grafana", "product": "grafana/grafana", "versions": [{"status": "affected", "version": "9.3.0", "lessThan": "11.6.10+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.1.6+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "lessThan": "12.2.4+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "lessThan": "12.3.2+security-01", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "grafana/grafana-enterprise", "versions": [{"status": "affected", "version": "9.3.0", "lessThan": "11.6.10+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.1.6+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.2.0", "lessThan": "12.2.4+security-01", "versionType": "semver"}, {"status": "affected", "version": "12.3.0", "lessThan": "12.3.2+security-01", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-12T07:13:06.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21722", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:42.160Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21722", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:42.160Z", "dateReserved": "2026-01-05T09:26:06.214Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-02-12T08:49:05.678Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "grafana/grafana", "vendor": "Grafana", "versions": [{"lessThan": "11.6.10+security-01", "status": "affected", "version": "9.3.0", "versionType": "semver"}, {"lessThan": "12.1.6+security-01", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "12.2.4+security-01", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThan": "12.3.2+security-01", "status": "affected", "version": "12.3.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "grafana/grafana-enterprise", "vendor": "Grafana", "versions": [{"lessThan": "11.6.10+security-01", "status": "affected", "version": "9.3.0", "versionType": "semver"}, {"lessThan": "12.1.6+security-01", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "12.2.4+security-01", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThan": "12.3.2+security-01", "status": "affected", "version": "12.3.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC76AD1C-B27B-406D-A117-4A77843DB73E", "versionEndExcluding": "11.6.10", "versionStartIncluding": "9.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5BEDACC-A177-4E74-B3A7-262519FEE855", "versionEndExcluding": "12.1.6", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A9AE662-36F4-4B97-8B4C-78E93587D100", "versionEndIncluding": "12.2.4", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "97D48B2B-3863-409D-BC93-778972C04854", "versionEndIncluding": "12.3.2", "versionStartIncluding": "12.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:11.6.10:-:*:*:*:*:*:*", "matchCriteriaId": "B6CAA7A9-874F-4C6A-B955-4DFBA2834355", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.1.6:-:*:*:*:*:*:*", "matchCriteriaId": "47FF05E9-65D7-43E8-93B0-111BA4708041", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.2.4:-:*:*:*:*:*:*", "matchCriteriaId": "4CF2D10C-CEE9-4D8C-9D46-F38DE3540FB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.2:-:*:*:*:*:*:*", "matchCriteriaId": "63FB712A-04AC-42FD-AC3C-1384932B662E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard."}, {"lang": "es", "value": "Los paneles p\u00fablicos con anotaciones habilitadas no limitaban su rango de tiempo de anotaciones al rango de tiempo bloqueado del panel p\u00fablico. Esto significaba que se pod\u00eda leer todo el historial de anotaciones visibles en el panel espec\u00edfico, incluso aquellas fuera del rango de tiempo bloqueado.\n\nEsto no filtraba ninguna anotaci\u00f3n que de otro modo no ser\u00eda visible en el panel p\u00fablico."}], "id": "CVE-2026-21722", "lastModified": "2026-06-17T10:18:58.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21722", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T14:24:06.337064Z", "version": "2.0.3"}}]}, "published": "2026-02-12T09:16:08.763", "references": [{"source": "security@grafana.com", "tags": ["Broken Link"], "url": "https://grafana.com/security/security-advisories/cve-2026-21722"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Public Dashboards time range restriction on annotations can be bypassed", "id": "2439292", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439292"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["A flaw was found in Grafana. Public dashboards with annotations enabled fail to limit their annotation time range to the locked time range of the public dashboard. This flaw allows an attacker to retrieve the entire history of annotations visible on that dashboard, including those outside the locked time range."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-21722", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-12T08:49:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21722\nhttps://grafana.com/security/security-advisories/CVE-2026-21722"], "statement": "This issue only exposes annotations that would otherwise be visible on the public dashboard if the time range were different, it does not leak annotations from private dashboards or data that is restricted by other permission models. Due to this reason, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.3.0,11.6.10+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.1.6+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.4+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.2+security-01)"}}], "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.3.0,11.6.10+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.1.6+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.4+security-01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.2+security-01)"}}], "product": "grafana_enterprise", "vendor": "grafana"}], "analysis": {"en": {"generated_at": "2026-04-15T17:16:26.619806+00:00", "value": {"mitigation_remediation": ["Obtain and install the latest Grafana release that contains the vendor patch addressing the annotation timerange restriction.", "If an immediate upgrade is not possible, disable public dashboard annotation visibility or configure annotation access to require authentication.", "Regularly review Grafana configuration and audit public dashboards to ensure that annotation settings are appropriately restricted."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Grafana (grafana/grafana) and Grafana Enterprise (grafana/grafana-enterprise) installations with versions including 11.6.10, 12.1.6, 12.2.4, 12.3.2, and all earlier builds affected by the CVE. Users should verify the exact Grafana version in use against the vendor release notes.", "description_and_impact": "This vulnerability allows a user to retrieve annotations that exist outside the enforced time window of a public dashboard. Because the annotation timerange was not limited to the dashboard\u2019s locked range, an attacker can read the full history of annotations that would otherwise be limited by the dashboard\u2019s time lock. The impact is that sensitive information that the dashboard owner chose to keep hidden within a narrower time frame may be exposed to any viewer who is granted access to the public dashboard. This is an information\u2011disclosure flaw classified under CWE\u2011200.", "risk_and_exploitability": "The vulnerability scores a CVSS of 5.3, indicating moderate severity. The EPSS score is below 1%, suggesting that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by accessing a public dashboard that has annotations enabled and may query the annotation API to retrieve annotations outside the locked timerange. No authentication is required beyond the typical public\u2011dashboard access, so any user who can view the dashboard could potentially read the broader annotation history."}}}}, "created": "2026-02-12T11:19:12.756304+00:00", "updated": "2026-04-15T17:30:10.476626+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}