CVE-2021-39226

    Dashboard / Vulnerabilities / CVE-2021-39226

    CVE-2021-39226

    Published: 5 Oct 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226, http://www.openwall.com/lists/oss-security/2021/10/05/4, https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/, https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/, https://security.netapp.com/advisory/ntap-20211029-0008/, https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269, https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6f8c1d9fe4421e02563097e03a389f1221126f57

    Affected versions

    v8.1.5
    v8.1.4
    v8.1.3
    v8.1.2
    v8.1.1
    v8.1.0
    v8.1.0-beta3
    v8.1.0-beta2
    v8.1.0-beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39226 | CVE-DB