CVE-2026-17183: An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side…

PriorityP342high7.1CVSS 3.1

AVNACLPRLUINSUCHILAN

EPSS

0.34%

27.5th percentile

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
grafana	grafana_enterprise	>= 12.4.0 < 12.4.9	12.4.9
grafana	grafana_enterprise	>= 13.0.0 < 13.0.7	13.0.7
grafana	grafana_enterprise	>= 13.1.0 < 13.1.4	13.1.4
grafana	grafana_enterprise	>= 8.4.0 < 12.3.11	12.3.11
grafana	grafana_oss	>= 12.4.0 < 12.4.9	12.4.9
grafana	grafana_oss	>= 13.0.0 < 13.0.7	13.0.7
grafana	grafana_oss	>= 13.1.0 < 13.1.4	13.1.4
grafana	grafana_oss	>= 8.4.0 < 12.3.11	12.3.11

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.