GHSA-x744-mm8v-vpgr BIT-grafana-2022-39201 CVE-2022-39201 GO-2024-2858

Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

High Go

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 1.67%; Chance of exploitation in the next 30 days. Higher than 76.85% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix: 8.5.14; Upgrade github.com/grafana/grafana to this version or later

Description

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39201

We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.

Release 9.2, latest release, also containing security fix:

Download Grafana 9.2

Release 9.1.8, only containing security fix:

Download Grafana 9.1.8

Release 8.5.14, only containing security fix:

Download Grafana 8.5.14

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.

CVE-2022-39201

Summary

On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions.

We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Impact

The destination plugin could receive a Grafana authentication cookie of the user.

Impacted versions

All installations for Grafana versions >= v5.0.0-beta1

Solutions and mitigations

To fully address CVE-2022-39201 please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

Reporting security issues

If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/grafana/grafana	`>= 5.0.0-beta1, < 8.5.14`	`8.5.14`
github.com/grafana/grafana	`>= 9.0.0, < 9.1.8`	`9.1.8`
github.com/grafana/grafana	`>= 5.0.0-beta1+incompatible`	No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/grafana/grafana Go → `8.5.14`

go

go get github.com/grafana/grafana@v8.5.14 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: Passive
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 6.8

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-39201

Packages

github.com/grafana/grafana

Timeline

Oct 13, 2022 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8pjx-jj86-j47p Grafana path traversal	High Known exploited	Also affects github.com/grafana/grafana
CVE-2021-39226 Authentication bypass for viewing and deletions of snapshots	High Known exploited	Also affects github.com/grafana/grafana
GHSA-3w66-95m3-8jxg Grafana: Pre-authentication denial of service in the public dashboard query handler	High	Also affects github.com/grafana/grafana
GHSA-9g84-39mm-q4p3 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug	Medium	Also affects github.com/grafana/grafana
GHSA-f74p-cwhp-x2wx Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.	High	Also affects github.com/grafana/grafana
GHSA-9493-h4f5-633x Grafana: Path traversal in the Tempo and Loki data source plugins	Medium	Also affects github.com/grafana/grafana
GHSA-wfhv-mj62-f5xh Grafana: Users can generate Service Account tokens after permissions removal	High	Also affects github.com/grafana/grafana
GHSA-gxcp-jjxh-rwp4 Grafana: SQL Expressions Read File From Disk	Medium	Also affects github.com/grafana/grafana

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor