RHSA-2026:76448

Vulnerability from csaf_redhat - Published: 2026-10-05 22:26 - Updated: 2026-10-06 04:11
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: grafana13.1: * grafana13.1-13.1.7-0.1.hum1 (aarch64, x86_64) * grafana13.1-13.1.7-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-863 - Incorrect Authorization
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-13720

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing administrators from modifying or deleting it through the Grafana web interface. The impact is restricted to the editor's organization and does not expose sensitive data.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 3 products, the same list as for CVE-2026-13719
Threats
Impact Moderate
CVE-2026-81841

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve sensitive data source configurations, potentially exposing stored credentials.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-862 - Missing Authorization
Affected products
Fixed 3 products, the same list as for CVE-2026-13719
Threats
Impact Moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.7-0.1.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.7-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:76448",
        "url": "https://access.redhat.com/errata/RHSA-2026:76448"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13720",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13720"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13719",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13719"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-81841",
        "url": "https://access.redhat.com/security/cve/CVE-2026-81841"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76448.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-06T04:11:16+00:00",
      "generator": {
        "date": "2026-10-06T04:11:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:76448",
      "initial_release_date": "2026-10-05T22:26:33+00:00",
      "revision_history": [
        {
          "date": "2026-10-05T22:26:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-05T23:08:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-06T04:11:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.7-0.1.hum1@aarch64",
                "product": {
                  "name": "grafana13.1-0:13.1.7-0.1.hum1@aarch64",
                  "product_id": "grafana13.1-0:13.1.7-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.7-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.7-0.1.hum1@src",
                "product": {
                  "name": "grafana13.1-0:13.1.7-0.1.hum1@src",
                  "product_id": "grafana13.1-0:13.1.7-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.7-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.1-0:13.1.7-0.1.hum1@x86_64",
                "product": {
                  "name": "grafana13.1-0:13.1.7-0.1.hum1@x86_64",
                  "product_id": "grafana13.1-0:13.1.7-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.7-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64"
        },
        "product_reference": "grafana13.1-0:13.1.7-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.7-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src"
        },
        "product_reference": "grafana13.1-0:13.1.7-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.1-0:13.1.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
        },
        "product_reference": "grafana13.1-0:13.1.7-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13719",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-09-30T11:21:02.069718+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw allows an authenticated Grafana user to retrieve alert-rule configurations from folders they cannot read by querying the alert-rule list API. Disclosure is limited to the organization\u2019s rule configurations; data source credentials are not exposed. Red Hat products shipping Grafana builds with the vulnerable behavior are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13719",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-13719",
          "url": "https://grafana.com/security/security-advisories/cve-2026-13719"
        }
      ],
      "release_date": "2026-09-30T11:06:38.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76448"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API"
    },
    {
      "cve": "CVE-2026-13720",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-09-30T11:21:20.830493+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543886"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing administrators from modifying or deleting it through the Grafana web interface. The impact is restricted to the editor\u0027s organization and does not expose sensitive data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543886",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543886"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13720",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13720",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-13720",
          "url": "https://grafana.com/security/security-advisories/cve-2026-13720"
        }
      ],
      "release_date": "2026-09-30T11:06:38.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76448"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata"
    },
    {
      "cve": "CVE-2026-81841",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-29T20:41:44.158139+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve sensitive data source configurations, potentially exposing stored credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate because exploitation is restricted to unauthorized information disclosure and requires prior knowledge of the specific URL for a publicly shared dashboard. In standard Red Hat product configurations, public dashboard sharing is not enabled by default, significantly limiting overall exposure. Even if an unauthenticated user obtains the link to a paused dashboard, the impact is confined to viewing frontend bootstrap configurations and exposed data source details rather than enabling write privileges or host compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-81841",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81841",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-81841",
          "url": "https://grafana.com/security/security-advisories/cve-2026-81841"
        }
      ],
      "release_date": "2026-09-29T20:35:57.152000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76448"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw without disabling features, permanently delete public shared dashboards rather than pausing them, which immediately revokes the associated access token.\n\nAlternatively, disable the public dashboard capability entirely by setting the following in `/etc/grafana/grafana.ini`:\n\n```ini\n[public_dashboards]\nenabled = false\n```\n\nOr configure the corresponding environment variable:\n`GF_PUBLIC_DASHBOARDS_ENABLED=false`\n\nApply the configuration by restarting the service:\n```bash\nsystemctl restart grafana-server\n```\n\nWarning: Restarting the `grafana-server` service will cause a brief interruption in service availability. Disabling public dashboards will prevent all unauthenticated access and sharing of dashboards across the environment.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.1-0:13.1.7-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.