CVE-2025-3454: 
Grafana vulnerability analysis and mitigation

A vulnerability was discovered in Grafana's data source proxy API (CVE-2025-3454) that allows authorization checks to be bypassed by adding an extra slash character in the URL path. The vulnerability was disclosed on June 2, 2025, affecting Grafana's datasource proxy API implementation, particularly impacting datasources that implement route-specific permissions, including Alertmanager and Prometheus-based datasources (Grafana Advisory, NVD).

The vulnerability allows users with minimal permissions to bypass authorization checks in Grafana's datasource proxy API by manipulating the URL path with an extra slash character. The issue has been assigned a CVSS v3.1 base score of 5.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N and is classified under CWE-285 (Improper Authorization) (NVD, Wiz).

The vulnerability primarily affects datasources implementing route-specific permissions. When exploited, it allows users with minimal permissions to gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources (Grafana Advisory).

The vulnerability has been patched in multiple Grafana versions including v10.4.17+security-01, v11.2.8+security-01, v11.3.5+security-01, v11.4.3+security-01, v11.5.3+security-01, and v11.6.0+security-01. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Grafana Advisory).