Bug 2507636 (CVE-2026-9703)

Summary: CVE-2026-9703 grafana: Grafana: Viewer role can create, modify and delete Loki alerting rules
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source. Exploitation requires an authenticated Viewer account and a configured Loki data source. Both Grafana OSS and Grafana Enterprise are affected. Loki itself is not vulnerable.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 20:00:38 UTC 
*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-19137 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***

CVE-2026-9703 is a confirmed, exploitable authorization bypass vulnerability affecting all Red Hat products that ship Grafana OSS. The missing access-control check on the data source proxy is in the core OSS alerting subsystem — code fully compiled and reachable in Red Hat builds (confirmed via RPM spec 'oss' build tag analysis and container image inspection). Any authenticated Viewer-role user can create, modify, or delete Loki/Prometheus alerting rules without authorization. No configuration workaround exists; upgrade is required. The vulnerability is exploitable over normal authenticated HTTPS traffic, bypassing all container-level and OS-level security controls (SELinux, seccomp, NetworkPolicies). RHACM 2 has the highest exposure due to multi-tenant OpenShift clusters with Viewer-role users accessing Grafana via OpenShift Routes. Four of the six disclosed CVEs (CVE-2026-10088, CVE-2026-13000, CVE-2026-11574, CVE-2026-10084) target Enterprise-only features (Recorded Queries, Git Sync, SAML) whose code is excluded at compile time by the Go 'oss' build tag — these are NOT APPLICABLE and should be marked not-affected. CVE-2026-11817 (cross-org permission metadata disclosure, CVSS 5.3) is potentially applicable as the multi-org API exists in OSS, but practical impact is low: multi-org deployments are uncommon in Red Hat product contexts, exploitation requires Org Admin privilege, and only dashboard/folder IDs and permission mappings are exposed (no content, credentials, or personal data). CVE-2026-11817 should be tracked as a secondary Low-impact flaw.