CVE-2026-21727

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21727", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-01-05T09:26:06.215Z", "datePublished": "2026-04-15T18:57:25.185Z", "dateUpdated": "2026-08-27T17:22:44.594Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:44.594Z"}, "datePublic": "2026-04-15T18:52:20.510Z", "title": "Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record", "descriptions": [{"lang": "en", "value": "A cross-tenant isolation vulnerability was found in Grafana\u2019s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability."}], "affected": [{"vendor": "Grafana", "product": "Grafana Correlations", "defaultStatus": "unaffected", "versions": [{"version": "10.2.0", "status": "affected", "versionType": "semver", "lessThan": "12.4.0"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21727", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"}}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T19:56:51.668906Z", "id": "CVE-2026-21727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T18:59:38.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T19:56:51.668906Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T19:56:56.495Z"}}], "cna": {"title": "Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Correlations", "versions": [{"status": "affected", "version": "10.2.0", "lessThan": "12.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-15T18:52:20.510Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21727", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A cross-tenant isolation vulnerability was found in Grafana\u2019s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-26T08:50:37.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21727", "state": "PUBLISHED", "dateUpdated": "2026-08-26T08:50:37.782Z", "dateReserved": "2026-01-05T09:26:06.215Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-04-15T18:57:25.185Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Correlations", "vendor": "Grafana", "versions": [{"lessThan": "12.4.0", "status": "affected", "version": "10.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "E222AE63-CF86-4357-8D11-A35DCB08CF04", "versionEndExcluding": "11.6.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "303497E8-487F-438B-BD49-0B5494FE1D9C", "versionEndExcluding": "12.0.9", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DFA2773-579E-444B-A8DC-200D8211D231", "versionEndExcluding": "12.1.6", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2BDFDFB-565D-4E2C-B32F-E4B66630CA19", "versionEndExcluding": "12.2.4", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "E33CA4BF-8698-4307-87FB-7C6B56287003", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-tenant isolation vulnerability was found in Grafana\u2019s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability."}, {"lang": "es", "value": "title: Divulgaci\u00f3n y Eliminaci\u00f3n de Correlaci\u00f3n Heredada Entre Inquilinos\ndraft: false\nhero: image: /static/img/heros/hero-legal2.svg content: \u201c# Divulgaci\u00f3n y Eliminaci\u00f3n de Correlaci\u00f3n Heredada Entre Inquilinos\u201d\ndate: 2026-01-29\nproduct: Grafana\nseverity: Baja\ncve: CVE-2026-21727\ncvss_score: \u201c3.3\u201d\ncvss_vector: \u201cCVSS:3.3/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N\u201d\nfixed_versions: - \u201cmayor o igual que 11.6.11 mayor o igual que 12.0.9 mayor o igual que 12.1.6 mayor o igual que 12.2.4\u201d\n---\nSe encontr\u00f3 una vulnerabilidad de aislamiento entre inquilinos en la caracter\u00edstica de Correlaciones de Grafana que afecta a los registros de correlaci\u00f3n heredados. Debido a una condici\u00f3n de compatibilidad con versiones anteriores que permite que los registros con org_id = 0 sean devueltos entre organizaciones, un usuario con privilegios de gesti\u00f3n de fuentes de datos podr\u00eda leer y eliminar permanentemente datos de correlaci\u00f3n heredados pertenecientes a otra organizaci\u00f3n. Este problema afecta a las correlaciones creadas antes de Grafana 10.2 y est\u00e1 solucionado en mayor o igual que 11.6.11, mayor o igual que 12.0.9, mayor o igual que 12.1.6 y mayor o igual que 12.2.4. Gracias a Gyu-hyeok Lee (g2h) por informar de esta vulnerabilidad."}], "id": "CVE-2026-21727", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 2.5, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21727", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T19:56:51.668906Z", "version": "2.0.3"}}]}, "published": "2026-04-15T20:16:34.290", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-21727"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "Grafana: Grafana: Cross-tenant data disclosure and deletion via legacy correlation records", "id": "2458787", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458787"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-653", "details": ["A flaw was found in Grafana. This cross-tenant isolation vulnerability affects legacy correlation records, specifically those created prior to Grafana 10.2. A user with datasource management privileges can exploit a backward compatibility condition, which allows records with an organization ID (org_id) of 0 to be returned across different organizations. This enables the user to read and permanently delete sensitive correlation data belonging to other organizations."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-21727", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-15T18:57:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21727\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21727\nhttps://grafana.com/security/security-advisories/cve-2026-21727"], "statement": "This Low impact cross-tenant isolation vulnerability in Grafana affects legacy correlation records created prior to Grafana 10.2. A user with datasource management privileges could read and permanently delete correlation data from other organizations due to a backward compatibility condition. Red Hat products utilizing Grafana with such legacy records are affected. Red Hat Product Seurity team has rated this vulnerability as having a Low severity, this is due the fact the attacker needs to have high privileges within the targeted Grafana instance and additionally the system needs to be making using of legacy correlation records limiting the confidentiality and integrity impact for the related records.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[10.2.0,12.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Grafana Correlations", "source": "cna", "vendor": "Grafana"}, "product": "grafana_correlations", "vendor": "grafana"}], "created": "2026-04-15T22:15:15.708143+00:00", "updated": "2026-08-22T14:00:17.681350+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana_correlations"]}