All vulnerabilities
CVE-2026-21727BIT-grafana-2026-21727GHSA-p5x9-j974-rpfpGO-2026-6664

github.com/grafana/grafana: Grafana legacy correlations allow cross-tenant disclosure and deletion

Grafana github.com/grafana/grafanagoApplications & CMS
Open in ThreatlineRecord JSON
CVSS
3.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.9.2-0.20260127141016-e702db6096e0Also 12.4.0GitHub
Published15 Apr 2026Updated 7 Oct 2026CVE List

What fixes it

  • 1.9.2-0.20260127141016-e702db6096e0github.com/grafana/grafana, goGitHubgo get github.com/grafana/grafana@v1.9.2-0.20260127141016-e702db6096e0
  • 12.4.0Grafana CorrelationsCVE List
  • 1.9.2-0.20260127141016-e702db6096e0github.com/grafana/grafana, GoOSVgo get github.com/grafana/grafana@v1.9.2-0.20260127141016-e702db6096e0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

--- hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana fixed_versions:

  • ">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4"

--- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/grafana/grafana, go< 1.9.2-0.20260127141016-e702db6096e0GitHub
  • Grafana Correlationsaffected: 10.2.0 before 12.4.0CVE List
  • github.com/grafana/grafana, Gofrom first release, fixed in 1.9.2-0.20260127141016-e702db6096e0OSV

References 9