CVE-2026-12933: RECORDED QUERIES REMOTE-WRITE VALIDATION COULD USE DATA SOURCE CREDENTIALS BEFORE CHECKING PERMISSIONS

Score: 6.4 (MEDIUM) 

Short description of the vulnerability: 

The Recorded Queries remote-write target creation endpoint in Grafana Enterprise validates the target connection using elevated credentials before checking whether the caller has permission to access the underlying datasource. An attacker with the Org Editor role can make Grafana send authenticated HTTP requests to arbitrary paths on a Prometheus datasource host, and infer information from upstream responses, without holding datasource query permissions. Only Grafana Enterprise instances with Recorded Queries enabled are affected; Grafana OSS is not affected. 

Known mitigations: 

Disable Recorded Queries until the security update is installed, or restrict Editor access to trusted users and restrict the data source credentials and network access. 

Affected products and versions: 

Grafana Enterprise only, with Recorded Queries enabled. 

12.4.0 to 12.4.14, 13.0.0 to 13.0.12, and 13.1.0 to 13.1.9 (plain public builds). Older affected builds include 11.6.0 to 11.6.16, 12.0.0 to 12.2.10, and 12.3.0 to 12.3.11. 

Grafana Enterprise 13.2.0 and later already contain these fixes. The June private builds carried the fixes, but later private builds on the older lines dropped them. Install the 27 October security build rather than relying on the June patch level. 

Fixed in: 

12.4.14+security-01 

13.0.12+security-01 

13.1.9+security-01 

13.2.5+security-01 

13.3.0+security-01 

The fixes are inherited from public 13.2.0 on the 13.2 and 13.3 lines; this release restores them on the older supported lines. 

Affected platforms: 

Self-managed (on-premise)