Improper access control in Grafana - CVE-2026-21722

Vulnerability identifier: #VU122756

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21722

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the application does not limit their annotation timerange to the locked timerange of the public dashboard with annotations enabled. A remote attacker can read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

Grafana
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Multi-Linux Manager Beta Client Tools for SLE Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Server for SAP Applications
SUSE Multi-Linux Manager Beta Client Tools for SLE
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
mgrctl-lang
mgrctl-zsh-completion
mgrctl-bash-completion
mgrctl
mgrctl-debuginfo
firewalld-prometheus-config
dracut-wireless
golang-github-QubitProducts-exporter_exporter
python3-defusedxml
prometheus-postgres_exporter-debuginfo
prometheus-postgres_exporter
golang-github-prometheus-promu-debuginfo
golang-github-prometheus-promu
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager-debuginfo
golang-github-prometheus-alertmanager
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
dracut-saltboot
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-prometheus-node_exporter-debuginfo
golang-github-boynux-squid_exporter-debuginfo
golang-github-boynux-squid_exporter
golang-github-prometheus-prometheus
golang-github-prometheus-prometheus-debuginfo
spacecmd
supportutils-plugin-susemanager-client
python3-mgr-push
python3-uyuni-common-libs
mgr-push
python3-rhnlib
python3-spacewalk-client-tools
spacewalk-client-tools
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
grafana-debuginfo
grafana
venv-salt-minion

Install updates from vendor's website.

Grafana - addressed in versions 11.6.10+security-01, 12.1.6+security-01, 12.2.4+security-01, 12.3.2+security-01
mgrctl-lang - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-zsh-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-bash-completion - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
mgrctl-debuginfo - addressed in versions 0.1.38-150000.1.30.1, 5.2.5-159000.2.3.2
firewalld-prometheus-config - addressed in versions 0.1-150000.3.67.1, 0.1-159000.4.3.2
dracut-wireless - update to 0.1.1595937550.0285244-159000.2.2.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.21.1, 0.4.0-159000.2.2.1
python3-defusedxml - update to 0.7.1-159000.4.2.1
prometheus-postgres_exporter-debuginfo - update to 0.10.1-159000.2.2.1
prometheus-postgres_exporter - update to 0.10.1-159000.2.2.1
golang-github-prometheus-promu-debuginfo - update to 0.17.0-150000.3.30.1
golang-github-prometheus-promu - update to 0.17.0-150000.3.30.1
prometheus-blackbox_exporter - addressed in versions 0.26.0-150000.1.30.2, 0.26.0-159000.2.2.1
golang-github-prometheus-alertmanager-debuginfo - update to 0.28.1-159000.12.2.1
golang-github-prometheus-alertmanager - update to 0.28.1-159000.12.2.1
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
golang-github-lusitaniae-apache_exporter-debuginfo - addressed in versions 1.0.10-150000.1.26.1, 1.0.10-159000.2.2.1
dracut-saltboot - addressed in versions 1.1.0-150000.1.65.1, 1.1.0-159000.2.2.1
supportutils-plugin-salt - update to 1.2.3-159000.4.2.1
golang-github-prometheus-node_exporter - update to 1.9.1-159000.4.2.1
golang-github-prometheus-node_exporter-debuginfo - update to 1.9.1-159000.4.2.1
golang-github-boynux-squid_exporter-debuginfo - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-boynux-squid_exporter - addressed in versions 1.13.0-150000.1.12.1, 1.13.0-159000.2.2.1
golang-github-prometheus-prometheus - addressed in versions 3.5.0-150000.3.67.1, 3.5.0-159000.4.3.2
golang-github-prometheus-prometheus-debuginfo - update to 3.5.0-159000.4.3.2
spacecmd - addressed in versions 5.0.15-150000.3.142.1, 5.2.6-159000.4.3.1
supportutils-plugin-susemanager-client - update to 5.2.2-159000.4.2.1
python3-mgr-push - update to 5.2.3-159000.2.3.1
python3-uyuni-common-libs - update to 5.2.3-159000.2.3.1
mgr-push - update to 5.2.3-159000.2.3.1
python3-rhnlib - update to 5.2.4-159000.4.3.1
python3-spacewalk-client-tools - update to 5.2.4-159000.4.3.1
spacewalk-client-tools - update to 5.2.4-159000.4.3.1
Multi-Linux-ManagerTools-Beta-SLE-Micro-release - update to 5-159000.3.3.1
grafana-debuginfo - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1, 11.6.11-159000.2.3.2
grafana - addressed in versions 11.6.11-150000.1.90.1, 11.6.11-150200.3.83.1, 11.6.11-159000.2.3.2
venv-salt-minion - update to 3006.0-159000.5.3.2

• https://grafana.com/security/security-advisories/cve-2026-21722/

• Multiple vulnerabilities in Grafana
• SUSE update for grafana
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools