CVE-2026-13720
published 2026-09-30CVE-2026-13720: An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
0.16%
4.4th percentile
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | 12.0.0 – 12.0.10 | — |
| grafana | grafana_enterprise | 12.1.0 – 12.1.10 | — |
| grafana | grafana_enterprise | 12.2.0 – 12.2.11 | — |
| grafana | grafana_enterprise | 12.3.0 – 12.3.11 | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.3 | 13.2.3 |
| grafana | grafana_oss | 12.0.0 – 12.0.10 | — |
| grafana | grafana_oss | 12.1.0 – 12.1.10 | — |
| grafana | grafana_oss | 12.2.0 – 12.2.11 | — |
| grafana | grafana_oss | 12.3.0 – 12.3.11 | — |
| grafana | grafana_oss | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.3 | 13.2.3 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
vendor_redhat·2026-09-30·CVSS 5.4
CVE-2026-13720 [MEDIUM] CWE-915 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing administrators from modifying or deleting it through the Grafana web interface. The impact is restricted to the editor's organization and does not expose sensitive data.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Affected
Package: rhceph/grafana-rhel9 (Re
GHSA
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because thes
ghsa_unreviewed·2026-09-30
CVE-2026-13720 [MEDIUM] CWE-285 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because thes
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata [fedora-all]
bugzilla·2026-09-30·CVSS 5.4
CVE-2026-13720 [MEDIUM] CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata [fedora-all]
CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Bugzilla
CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
bugzilla·2026-09-30·CVSS 5.4
CVE-2026-13720 [MEDIUM] CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
2026-09-30
Published