Grafana Labs < 11.6.14+security-04 / 12.2.0 < 12.2.8+security-04 / 12.3.0 < 12.3.6+security-04 / 12.4.0 < 12.4.3+security-02 / 13.0.0 < 13.0.1+security-01 Multiple Vulnerabilities

high Nessus Plugin ID 316482

Language:

Synopsis

The remote host is missing a security update.

Description

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:
- A broken access control flaw in the Snapshot API allows any Editor to delete dashboard snapshots, even those they have no read or write access to. (CVE-2026-28380)

- When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses, allowing the intended whitelist to be bypassed. (CVE-2026-33376)

- Dashboard import overwrites the dashboard ACL, allowing an Editor to overwrite a dashboard not owned by them and acquire admin on that specific dashboard. (CVE-2026-33377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update Grafana Labs to 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, 13.0.1+security-01 or later.

Plugin Details

Severity: High

ID: 316482

File Name: grafana_13_0_1_01.nasl

Version: 1.3

Type: Remote

Family: Web Servers

Published: 5/22/2026

Updated: 6/18/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.66

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-33381

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:grafana:grafana

Required KB Items: installed_sw/Grafana Labs

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2026

Vulnerability Publication Date: 5/13/2026

Reference Information

CVE: CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380, CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378, CVE-2026-33380, CVE-2026-33381

IAVB: 2026-B-0128

Detections

Analytics