UpHeron
All vulnerabilities

Servers and applications

CVE-2021-39226

CVE-2021-39226 Snapshot authentication bypass

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Aug 2022.

Severity
High 7.3
Published
5 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.5.11, 8.1.6
Also known as
GHSA-69j6-29vr-p3j9
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • Every version before 7.5.11
  • From 8.0.0 before 8.1.6
GrafanaServers and applications · github:grafana/grafana
  • Every version before 7.5.11

Known exploited

CISA name
Grafana Authentication Bypass Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
15 Sept 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-39226
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-39226
  • GitHub Advisory Database https://github.com/advisories/GHSA-69j6-29vr-p3j9
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9