Main Vulnerability Database Vulnerabilities #VU122159

Improper privilege management in Grafana - CVE-2026-21721

Published: January 30, 2026 / Updated: February 6, 2026

Vulnerability identifier: #VU122159

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21721

CWE-ID: CWE-269

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to improper privilege management when displaying visualization panels. A remote user can view panels they have no access to.

Affected software

Grafana
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Package Hub 15
openSUSE Leap
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
mgrctl
mgrctl-debuginfo
mgrctl-lang
mgrctl-zsh-completion
mgrctl-bash-completion
firewalld-prometheus-config
golang-github-QubitProducts-exporter_exporter
golang-github-prometheus-promu
golang-github-prometheus-promu-debuginfo
prometheus-blackbox_exporter
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
golang-github-boynux-squid_exporter-debuginfo
golang-github-boynux-squid_exporter
golang-github-prometheus-prometheus
spacecmd
grafana (Red Hat package)
grafana
grafana-debuginfo

How to mitigate CVE-2026-21721

Install updates from vendor's website.

Grafana - addressed in versions 11.6.9+security-01, 12.0.8+security-01, 12.1.5+security-01, 12.2.3+security-01, 12.3.1+security-01
mgrctl - update to 0.1.38-150000.1.30.1
mgrctl-debuginfo - update to 0.1.38-150000.1.30.1
mgrctl-lang - update to 0.1.38-150000.1.30.1
mgrctl-zsh-completion - update to 0.1.38-150000.1.30.1
mgrctl-bash-completion - update to 0.1.38-150000.1.30.1
firewalld-prometheus-config - update to 0.1-150000.3.67.1
golang-github-QubitProducts-exporter_exporter - update to 0.4.0-150000.1.21.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - update to 0.26.0-150000.1.30.2
golang-github-lusitaniae-apache_exporter - update to 1.0.10-150000.1.26.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.10-150000.1.26.1
dracut-saltboot - update to 1.1.0-150000.1.65.1
golang-github-boynux-squid_exporter-debuginfo - update to 1.13.0-150000.1.12.1
golang-github-boynux-squid_exporter - update to 1.13.0-150000.1.12.1
golang-github-prometheus-prometheus - update to 3.5.0-150000.3.67.1
spacecmd - update to 5.0.15-150000.3.142.1
grafana (Red Hat package) - addressed in versions 10.2.6-17.el9_6, 10.2.6-18.el9_7, 10.2.6-20.el10_0, 10.2.6-22.el10_1
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1

Links to Public Exploits and PoC-codes

Exploit #12375 - Exploit-LPE-CVE-2026-21721 (Эксплоит на CVE-2026-21721) (February 6, 2026)

External References

https://grafana.com/security/security-advisories/cve-2026-21721/