Bug 2565236 (CVE-2026-12933)

Summary: CVE-2026-12933 grafana: RECORDED QUERIES REMOTE-WRITE VALIDATION COULD USE DATA SOURCE CREDENTIALS BEFORE CHECKING PERMISSIONS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, security-response-team, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Grafana. The Recorded Queries remote-write target creation endpoint validates target connections using elevated credentials before verifying whether the caller has permission to access the underlying data source. An authenticated attacker with organization editor privileges can exploit this flaw to send authenticated HTTP requests to arbitrary paths on a connected data source host and infer sensitive information from upstream responses.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-10   

Description OSIDB Bzimport 2026-11-02 16:02:21 UTC 
CVE-2026-12933: RECORDED QUERIES REMOTE-WRITE VALIDATION COULD USE DATA SOURCE CREDENTIALS BEFORE CHECKING PERMISSIONS

Score: 6.4 (MEDIUM) 

Short description of the vulnerability: 

The Recorded Queries remote-write target creation endpoint in Grafana Enterprise validates the target connection using elevated credentials before checking whether the caller has permission to access the underlying datasource. An attacker with the Org Editor role can make Grafana send authenticated HTTP requests to arbitrary paths on a Prometheus datasource host, and infer information from upstream responses, without holding datasource query permissions. Only Grafana Enterprise instances with Recorded Queries enabled are affected; Grafana OSS is not affected. 

Known mitigations: 

Disable Recorded Queries until the security update is installed, or restrict Editor access to trusted users and restrict the data source credentials and network access. 

Affected products and versions: 

Grafana Enterprise only, with Recorded Queries enabled. 

12.4.0 to 12.4.14, 13.0.0 to 13.0.12, and 13.1.0 to 13.1.9 (plain public builds). Older affected builds include 11.6.0 to 11.6.16, 12.0.0 to 12.2.10, and 12.3.0 to 12.3.11. 

Grafana Enterprise 13.2.0 and later already contain these fixes. The June private builds carried the fixes, but later private builds on the older lines dropped them. Install the 27 October security build rather than relying on the June patch level. 

Fixed in: 

12.4.14+security-01 

13.0.12+security-01 

13.1.9+security-01 

13.2.5+security-01 

13.3.0+security-01 

The fixes are inherited from public 13.2.0 on the 13.2 and 13.3 lines; this release restores them on the older supported lines. 

Affected platforms: 

Self-managed (on-premise)