CVE-2026-15815
published 2026-09-17CVE-2026-15815: Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic…
PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.69%
51.7th percentile
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entries to escape the plugin installation directory, writing arbitrary files and an
executable backend binary outside that directory. The dropped executable runs with the
privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin
signature does not prevent the write. An operator can therefore be affected by
installing a plugin that appears legitimate, as well as by installing a plugin from an
arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or
preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as
Grafana OSS.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | — | — |
| grafana | grafana_enterprise | — | — |
| grafana | grafana_enterprise | — | — |
| grafana | grafana_enterprise | — | — |
| grafana | grafana_enterprise | 11.6.0 – 11.6.17 | — |
| grafana | grafana_enterprise | 12.4.0 – 12.4.10 | — |
| grafana | grafana_enterprise | 13.0.0 – 13.0.8 | — |
| grafana | grafana_enterprise | 13.1.0 – 13.1.5 | — |
| grafana | grafana_enterprise | 13.2.0 – 13.2.1 | — |
| grafana | grafana_oss | — | — |
| grafana | grafana_oss | — | — |
| grafana | grafana_oss | — | — |
| grafana | grafana_oss | — | — |
| grafana | grafana_oss | 11.6.0 – 11.6.17 | — |
| grafana | grafana_oss | 12.4.0 – 12.4.10 | — |
| grafana | grafana_oss | 13.0.0 – 13.0.8 | — |
| grafana | grafana_oss | 13.1.0 – 13.1.5 | — |
| grafana | grafana_oss | 13.2.0 – 13.2.1 | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
ghsa_unreviewed·2026-09-17
CVE-2026-15815 [HIGH] CWE-22 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entries to escape the plugin installation directory, writing arbitrary files and an
executable backend binary outside that directory. The dropped executable runs with the
privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin
signature does not prevent the write. An operator can therefore be affected by
installing a plugin that appears legitimate, as well as by installing a plugin from an
arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or
preinstall configuration.
Grafana Enterprise is af
Red Hat
grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
vendor_redhat·2026-09-30·CVSS 8.8
CVE-2026-15815 [HIGH] CWE-22 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entries to escape the plugin installation directory, writing arbitrary files and an
executable backend binary outside that directory. The dropped executable runs with the
privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin
signature does not prevent the write. An operator can therefore be affected by
installing a plugin that appears legitimate, as well as by installing a plugin from an
arbitrary archive using grafana-cli, the GF_INS
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION [fedora-all]
bugzilla·2026-10-01·CVSS 8.8
CVE-2026-15815 [HIGH] CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION [fedora-all]
CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Short description of the vulnerability: Grafana did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symbolic-link entries to escape the plugin installation directory, write arbitrary files, and drop an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, which is remote code execution. Plugin archives are extracted before t
Bugzilla
CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
bugzilla·2026-09-02·CVSS 8.8
CVE-2026-15815 [HIGH] CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
Short description of the vulnerability: Grafana did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symbolic-link entries to escape the plugin installation directory, write arbitrary files, and drop an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, which is remote code execution. Plugin archives are extracted before their signature is verified, so a valid signature does not prevent the write, and the payload also passes catalogue validation and signing. An instance can therefore be affected by installing a plugin that appears legitimate, as well as by
2026-09-17
Published