CVE-2026-21721: 
Grafana vulnerability analysis and mitigation

CVE-2026-21721 is an incorrect authorization vulnerability in Grafana's dashboard permissions API that enables organization-internal privilege escalation. The API fails to verify the target dashboard scope and only checks whether the caller holds the dashboards.permissions:* action, allowing any user with permission management rights on a single dashboard to read and modify permissions on all other dashboards within the organization. It affects Grafana (OSS and Enterprise) versions 10.2.0 through 11.6.8, 12.0.0 through 12.0.7, 12.1.0 through 12.1.4, and 12.2.0 through 12.2.2, as well as Grafana 12.3.0. The vulnerability was published on January 27, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Grafana Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): the dashboard permissions API endpoint performs an action-level check (dashboards.permissions:*) but omits a scope-level check to confirm the requesting user has rights over the specific target dashboard. An authenticated, low-privileged attacker can craft API requests targeting arbitrary dashboard UIDs or IDs outside their authorized scope, and the server will process them without rejecting the mismatched scope. No special configuration or elevated starting privileges beyond holding permission-management rights on at least one dashboard are required. A proof-of-concept exploit is publicly available on GitHub (PoC GitHub, Feedly).

A successful exploit allows an authenticated attacker to read and modify access-control permissions on any dashboard within the organization, effectively granting themselves or others administrative-level dashboard access. This can lead to unauthorized exposure of sensitive monitoring data (metrics, logs, infrastructure topology), lockout of legitimate users by revoking their permissions, and escalation to broader organizational access by granting elevated roles on high-value dashboards. Availability is not directly impacted, but confidentiality and integrity of dashboard access controls are both rated High (Grafana Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub (published approximately February 3, 2026) (PoC GitHub). As of the latest Feedly update, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.025% (0.000250), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus and Qualys scanners (Feedly).

1. Reconnaissance: Identify a Grafana instance running a vulnerable version (10.2.0–11.6.8, 12.0.0–12.0.7, 12.1.0–12.1.4, 12.2.0–12.2.2, or 12.3.0) using version disclosure on the login page or API endpoint /api/health.
2. Obtain low-privileged access: Authenticate to the Grafana instance with any account that has been granted dashboards.permissions:* on at least one dashboard (e.g., a dashboard editor or admin of a single team dashboard).
3. Enumerate dashboard IDs: Use the Grafana Search API (GET /api/search?type=dash-db) or the Dashboards API (GET /api/dashboards/home) to enumerate dashboard UIDs and IDs across the organization, which may be accessible to authenticated users.
4. Read permissions of arbitrary dashboards: Send a GET /api/dashboards/id/{targetDashboardId}/permissions request substituting a target dashboard ID outside the attacker's authorized scope. The API returns the full permission list without scope validation.
5. Modify permissions of arbitrary dashboards: Send a POST /api/dashboards/id/{targetDashboardId}/permissions request with a crafted JSON body to add, remove, or modify user/team/role permissions on the target dashboard, granting the attacker elevated access or locking out legitimate users.
6. Escalate privileges: Repeat step 5 to grant the attacker's account Admin-level permissions on high-value dashboards, enabling access to sensitive infrastructure metrics or further lateral movement within the organization (PoC GitHub, Grafana Advisory).

• Network: Unusual API calls to /api/dashboards/id/<ID>/permissions (GET or POST) from user accounts that do not own or administer the targeted dashboard; high volume of permission API requests across many different dashboard IDs from a single user session.
• Logs: Grafana server logs showing repeated GET or POST requests to /api/dashboards/id/*/permissions endpoints by a single low-privileged user account, especially targeting dashboards outside their normal scope; HTTP 200 responses to permission modification requests from unexpected users.
• Behavioral: Unexpected changes to dashboard permission lists (new users or roles added, existing users removed) visible in Grafana audit logs or the permissions UI; users reporting sudden loss of access to dashboards they previously managed.
• User Activity: A single user account making permission API calls against a large number of distinct dashboard IDs in a short time window, consistent with automated enumeration using the PoC tool (Grafana Advisory, Feedly).

Grafana has released patched versions: 11.6.9, 12.0.8, 12.1.5, 12.2.3, and 12.3.1. Organizations should upgrade to one of these versions immediately. As an interim workaround, audit all users holding dashboards.permissions:* privileges and restrict this permission to only those who strictly require it; implement network segmentation to limit access to the Grafana API; and review audit logs for unauthorized permission modifications. Red Hat has also issued errata (RHSA-2026:2914, RHSA-2026:2920, RHSA-2026:3078, RHSA-2026:3529) for affected downstream packages, and openSUSE/SUSE security updates are available (Grafana Advisory, Red Hat Errata).

The vulnerability was noted in CISA's weekly vulnerability bulletin for the week of January 26, 2026 (CISA Bulletin). Security community aggregators including TheHackerWire on Infosec.exchange flagged the disclosure shortly after publication. Qualys published detection guidance in their February 2026 application security detections summary. No major independent researcher write-ups or significant social media controversy have been identified beyond standard vulnerability tracking and patch notification channels (Feedly).