CVE-2026-21722: 
Grafana vulnerability analysis and mitigation

CVE-2026-21722 is an information disclosure vulnerability in Grafana's public dashboards feature, where annotation time range restrictions can be bypassed. When public dashboards have annotations enabled, the annotation query does not enforce the dashboard's locked time range, allowing unauthenticated users to retrieve the full annotation history visible on that dashboard — including entries outside the intended locked time window. The vulnerability was published on February 12, 2026, and affects Grafana versions from 9.3.0 through 12.3.2 (with fixed versions at 11.6.10, 12.1.6, 12.2.4, and 12.3.2). It carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-863 (Incorrect Authorization). When a public dashboard is configured with a locked time range, the backend annotation API endpoint fails to apply that time range constraint to annotation queries, returning results from the full annotation history instead of only the locked window. Exploitation requires no authentication, no user interaction, and no special privileges — an attacker only needs network access to a Grafana instance with a public dashboard that has annotations enabled. No public proof-of-concept code has been identified (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to read the complete annotation history of a public dashboard, bypassing the intended time range restriction. While the vulnerability does not expose annotations that are not otherwise visible on the dashboard (i.e., it does not cross dashboard-level access boundaries), it does circumvent temporal access controls, potentially revealing time-sensitive operational data, incident notes, or deployment markers that administrators intended to restrict. There is no impact on integrity or availability, and no direct path to lateral movement or code execution (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat Advisory, Feedly).

1. Reconnaissance: Identify Grafana instances with public dashboards enabled by browsing to publicly accessible Grafana URLs or using search engines/Shodan to find exposed Grafana instances running versions between 9.3.0 and 12.3.1.
2. Identify target dashboard: Navigate to a public dashboard URL (e.g., /public-dashboards/<uid>) and confirm that annotations are visible on the dashboard.
3. Query annotation API without time range restriction: Send a direct HTTP GET request to the Grafana annotation API endpoint used by the public dashboard (e.g., /api/annotations or the public dashboard-specific annotation endpoint), omitting or manipulating the from and to time range parameters that the locked dashboard would normally enforce.
4. Retrieve full annotation history: Parse the API response, which returns annotations from the full history rather than only those within the dashboard's locked time range, potentially revealing operational notes, incident markers, or deployment events outside the intended window (Red Hat Bugzilla, Red Hat Advisory).

• Network: Unusual or repeated HTTP GET requests to Grafana annotation API endpoints (e.g., /api/annotations, /api/public/dashboards/<uid>/annotations) from external or unexpected IP addresses, particularly without time range parameters or with manipulated from/to values.
• Logs: Grafana access logs showing annotation API calls from unauthenticated sessions (no auth token) against public dashboard endpoints with broad or missing time range parameters; high-frequency annotation queries from a single IP.
• Logs: Requests to public dashboard annotation endpoints returning large result sets inconsistent with the dashboard's locked time range.

Grafana has released patched versions: 11.6.10, 12.1.6, 12.2.4, and 12.3.2. Organizations should upgrade to one of these fixed versions as the primary remediation. As interim workarounds, administrators can disable annotations on public dashboards, restrict public dashboard access, or disable the public dashboards feature entirely until patching is feasible. Reviewing and auditing annotation content on public dashboards for sensitive information is also recommended (Red Hat Advisory, Grafana Advisory).

The vulnerability was noted in the r/CVEWatch subreddit as part of trending CVE roundups for February 12–13, 2026. The Secret CISO newsletter also referenced it in its February 13, 2026 edition. Community reaction has been relatively muted given the medium severity and limited exploitation potential. OpenSUSE and FreeBSD package maintainers issued security announcements and updated their Grafana packages in response (OpenSUSE Announce).