GHSA-jv32-5578-pxjc BIT-grafana-2022-31130 CVE-2022-31130 GO-2024-2851

Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

High Go

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 1.33%; Chance of exploitation in the next 30 days. Higher than 71.15% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor; CWE-522 Insufficiently Protected Credentials
Fix: 9.1.8; Upgrade github.com/grafana/grafana to this version or later

Description

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-31130

We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.

Release 9.2, latest release, also containing security fix:

Download Grafana 9.2

Release 9.1.8, only containing security fix:

Download Grafana 9.1.8

Release 8.5.14, only containing security fix:

Download Grafana 8.5.14

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.

CVE-2022-31130

Summary

On June 26 a security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis the vulnerability impacts data source and plugin proxy endpoints with authentication tokens but under some conditions.

We believe that this vulnerability is rated at CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Impact

The destination plugin could receive a Grafana authentication token of the user.

Impacted versions

All installations for Grafana versions <=9.x, <=8.x, <=7.x

Solutions and mitigations

To fully address CVE-2022-31130 please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

As a workaround do not use API keys, JWT authentication or any HTTP Header based authentication.

Reporting security issues

If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/grafana/grafana	`>= 9.0.0, < 9.1.8`	`9.1.8`
github.com/grafana/grafana	`>= 7.0.0, < 8.5.14`	`8.5.14`
github.com/grafana/grafana	`all versions`	No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/grafana/grafana Go → `9.1.8`

go

go get github.com/grafana/grafana@v9.1.8 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 4.9

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-522: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it

Architecture and Design: Use an appropriate security mechanism to protect the credentials.
Architecture and Design: Make appropriate use of cryptography to protect the credentials.
Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-31130

Packages

github.com/grafana/grafana

Timeline

Oct 13, 2022 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8pjx-jj86-j47p Grafana path traversal	High Known exploited	Also affects github.com/grafana/grafana
CVE-2021-39226 Authentication bypass for viewing and deletions of snapshots	High Known exploited	Also affects github.com/grafana/grafana
GHSA-3w66-95m3-8jxg Grafana: Pre-authentication denial of service in the public dashboard query handler	High	Also affects github.com/grafana/grafana
GHSA-9g84-39mm-q4p3 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug	Medium	Also affects github.com/grafana/grafana
GHSA-f74p-cwhp-x2wx Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.	High	Also affects github.com/grafana/grafana
GHSA-9493-h4f5-633x Grafana: Path traversal in the Tempo and Loki data source plugins	Medium	Also affects github.com/grafana/grafana
GHSA-wfhv-mj62-f5xh Grafana: Users can generate Service Account tokens after permissions removal	High	Also affects github.com/grafana/grafana
GHSA-gxcp-jjxh-rwp4 Grafana: SQL Expressions Read File From Disk	Medium	Also affects github.com/grafana/grafana

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor