CVE-2026-81841
published 2026-09-29CVE-2026-81841: Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.37%
29.6th percentile
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana_enterprise | 11.6.0 – 11.6.17 | — |
| grafana | grafana_enterprise | 12.0.0 – 12.0.10 | — |
| grafana | grafana_enterprise | 12.1.0 – 12.1.10 | — |
| grafana | grafana_enterprise | 12.2.0 – 12.2.11 | — |
| grafana | grafana_enterprise | 12.3.0 – 12.3.11 | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.3 | 13.2.3 |
| grafana | grafana_oss | 11.6.0 – 11.6.17 | — |
| grafana | grafana_oss | 12.0.0 – 12.0.10 | — |
| grafana | grafana_oss | 12.1.0 – 12.1.10 | — |
| grafana | grafana_oss | 12.2.0 – 12.2.11 | — |
| grafana | grafana_oss | 12.3.0 – 12.3.11 | — |
| grafana | grafana_oss | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.3 | 13.2.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data.
ghsa_unreviewed·2026-09-29
CVE-2026-81841 [MEDIUM] CWE-862 Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data.
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
VulDB
Grafana Enterprise/OSS up to 13.2.2 Shared Dashboard improper authorization
vuldb·2026-09-29·CVSS 5.3
CVE-2026-81841 [MEDIUM] Grafana Enterprise/OSS up to 13.2.2 Shared Dashboard improper authorization
A vulnerability has been found in Grafana Enterprise and OSS up to 13.2.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Shared Dashboard. The manipulation leads to improper authorization.
This vulnerability is referenced as CVE-2026-81841. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
Red Hat
grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
vendor_redhat·2026-09-29·CVSS 5.3
CVE-2026-81841 [MEDIUM] CWE-613 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards [fedora-all]
bugzilla·2026-10-05·CVSS 5.3
CVE-2026-81841 [MEDIUM] CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards [fedora-all]
CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Bugzilla
CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
bugzilla·2026-09-29·CVSS 5.3
CVE-2026-81841 [MEDIUM] CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
CVE-2026-81841 grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
2026-09-29
Published