CVE-2026-17183
HighCVSS 7.1Summary
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Risk Assessment
The risk involves unauthorized access to data stored in Grafana datasources, potentially leading to exposure of sensitive information.
Recommendation
It is recommended to update Grafana to a patched version and review user permissions for creating and editing alert rules.
Original NVD description (English source)
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.