Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl
    greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity
    attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who
    shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is
    live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).
    (CVE-2026-14199)

  - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the
    InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay
    protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session
    as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this
    setting is off by default and Grafana OSS is not affected. (CVE-2026-12704)

  - An authenticated user can list alert rules stored in folders they are not allowed to read through the
    alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction
    was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can
    trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not
    exposed. (CVE-2026-13719)

  - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and
    grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these
    fields were stored without an authorization check. The dashboard then appears file-provisioned, and
    administrators can no longer update or delete it through Grafana. The impact is limited to the same
    organization and no data is exposed. (CVE-2026-13720)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1180 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-81841:
    Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend     bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without     authenticating, the configuration of the dashboard's data sources, including stored credentials for data     sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

    CVE-2026-109345:
    DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass     sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries     markup.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend     bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without     authenticating, the configuration of the dashboard's data sources, including stored credentials for data     sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
    (CVE-2026-81841)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Grafana Labs installed on the remote host is 11.6.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by a missing authorization vulnerability:

  - Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend     bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without     authenticating, the configuration of the dashboard's data sources, including stored credentials for data     sources using browser access (missing authorization). Deleting the shared dashboard does revoke the     token. (CVE-2026-81841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478362	Alpine: multiple grafana packages: security update to 12.4.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
367402	TencentOS Server 4: grafana (TSSA-2026:1180)	Nessus	Tencent Local Security Checks	Local	medium
362958	Linux Distros Unpatched Vulnerability : CVE-2026-81841	Nessus	Misc.	Local	medium
362625	Grafana Labs 11.6.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Missing Authorization (CVE-2026-81841)	Nessus	Web Servers	Remote	medium

Detections

Analytics

CVE-2026-81841

medium

Tenable Plugins

high

high

medium

medium

medium