{"id":"CVE-2021-39226","published":"2021-10-05T18:15:07Z","modified":"2026-06-17T04:03:21Z","title":"Grafana Authentication Bypass Vulnerability","vendor":"Grafana Labs","product":"Grafana","tier":"core","eol":null,"description":{"text":"Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot \"public_mode\" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot \"public_mode\" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in Grafana's snapshot feature, part of the Grafana open source data visualization platform, lets users access and delete snapshots they should not be able to reach, through the /dashboard/snapshot/:key, /api/snapshots/:key and /api/snapshots-delete/:deleteKey paths. An unauthenticated attacker over the network can view and, if the public_mode setting is enabled, delete the lowest-keyed snapshot without any credentials or user interaction, while any authenticated user can delete it regardless of that setting, and repeated access allows a full walk through all snapshot data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:45Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.99933,"percentile":0.9997,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/; https://nvd.nist.gov/vuln/detail/CVE-2021-39226","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-19","exploitedFirstSeen":"2022-08-19","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2021-39226","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2021-39226","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2021-39226","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-24&host_type=src&vulnerability=cve-2021-39226","date":"2023-12-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-08&host_type=src&vulnerability=cve-2021-39226","date":"2024-01-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-09&host_type=src&vulnerability=cve-2021-39226","date":"2024-01-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-10&host_type=src&vulnerability=cve-2021-39226","date":"2024-01-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-11&host_type=src&vulnerability=cve-2021-39226","date":"2024-01-11"}],"evidenceTotal":449,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"},{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/10/05/4","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269","tags":["Patch"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/","tags":["Release Notes"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/","tags":["Broken Link"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/","tags":["Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0008/","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/05/4","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269","tags":["Patch"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/","tags":["Release Notes"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/","tags":["Broken Link"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/","tags":["Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0008/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39226","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published. \n\nIn exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the \"public_mode\" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss.","confidence":"high"},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published. \n\nIn exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the \"public_mode\" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss.","confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<7.5.11",">=8.0.0, <8.1.6"],"patched":["7.5.11","8.1.6"],"from":["GHSA-69j6-29vr-p3j9"],"provenance":"source"}],"advisories":[{"id":"GHSA-69j6-29vr-p3j9","url":"https://github.com/advisories/GHSA-69j6-29vr-p3j9","severity":"HIGH","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<7.5.11"],"patched":["7.5.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-69j6-29vr-p3j9","url":"https://github.com/advisories/GHSA-69j6-29vr-p3j9","severity":"HIGH","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=8.0.0, <8.1.6"],"patched":["8.1.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-2169","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2169","exploited":true,"exploitedSince":"2022-08-25","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-39226","name":"Grafana Snapshot - Authentication Bypass","severity":"high","path":"http/cves/2021/CVE-2021-39226.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39226.yaml"}],"provenance":"source"},"exploitRefs":["https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1485"],"provenance":"source"}],"timeline":[{"date":"2021-10-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39226","provenance":"source"},{"date":"2022-08-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","provenance":"source"},{"date":"2022-08-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2169","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":324},"priority":{"score":68.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1534 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-grafana-cve-2021-39226","children":[{"from":"CVE-2021-39226","to":"CVE-2022-39324","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/api/dashboard_snapshot.go"],"commits":["https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269","https://github.com/grafana/grafana/commit/239888f22983010576bb3a9135a7294e88c0c74a","https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c"],"basis":"shared function","functions":["CreateDashboardSnapshot"]}]}],"packageHistory":[{"cve":"CVE-2020-12458","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2020-12459","published":"2020-04-29","fixed":"7.2.1","kev":false},{"cve":"CVE-2021-27358","published":"2021-03-18","fixed":"7.4.2","kev":false,"link":{"from":"CVE-2021-27358","to":"CVE-2021-39226","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.4.2","toFixed":"7.5.11","daysApart":201}]}},{"cve":"CVE-2021-39226","published":"2021-10-05","fixed":"8.1.6","kev":true},{"cve":"CVE-2021-41244","published":"2021-11-15","fixed":"8.2.4","kev":false},{"cve":"CVE-2021-43798","published":"2021-12-07","fixed":"8.3.1","kev":true,"link":{"from":"CVE-2021-39226","to":"CVE-2021-43798","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.1.6","toFixed":"8.1.8","daysApart":63}]}},{"cve":"CVE-2021-43815","published":"2021-12-10","fixed":"8.3.2","kev":false},{"cve":"CVE-2022-21702","published":"2022-02-08","fixed":"8.3.5","kev":false,"link":{"from":"CVE-2021-39226","to":"CVE-2022-21702","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.5.11","toFixed":"7.5.15","daysApart":126}]}},{"cve":"CVE-2022-21713","published":"2022-02-08","fixed":"8.3.5","kev":false,"link":{"from":"CVE-2021-39226","to":"CVE-2022-21713","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"7.5.11","toFixed":"7.5.15","daysApart":126}]}}],"package":"Go:github.com/grafana/grafana"}}