CVE-2026-81841
Description
A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve sensitive data source configurations, potentially exposing stored credentials.
Statement
This vulnerability is rated as Moderate because exploitation is restricted to unauthorized information disclosure and requires prior knowledge of the specific URL for a publicly shared dashboard. In standard Red Hat product configurations, public dashboard sharing is not enabled by default, significantly limiting overall exposure. Even if an unauthenticated user obtains the link to a paused dashboard, the impact is confined to viewing frontend bootstrap configurations and exposed data source details rather than enabling write privileges or host compromise.
Mitigation
To mitigate this flaw without disabling features, permanently delete public shared dashboards rather than pausing them, which immediately revokes the associated access token.
Alternatively, disable the public dashboard capability entirely by setting the following in `/etc/grafana/grafana.ini`:
ini
[public_dashboards]
enabled = false
Or configure the corresponding environment variable:
`GF_PUBLIC_DASHBOARDS_ENABLED=false`
Apply the configuration by restarting the service:
bash
systemctl restart grafana-server
Warning: Restarting the `grafana-server` service will cause a brief interruption in service availability. Disabling public dashboards will prevent all unauthenticated access and sharing of dashboards across the environment.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
