CVE-2021-39226
Published: August 25, 2022
Official Description
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
CISA KEV Advisory
Grafana Authentication Bypass Vulnerability
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
Apply updates per vendor instructions.
Risk Analysis
Grafana has an authentication bypass vulnerability that allows both authenticated and unauthenticated users to view and delete all snapshot data. This could result in complete data loss for snapshots. The high EPSS score of 0.94350 indicates a very high likelihood of exploitation.
This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog. The authentication bypass makes it remotely exploitable by unauthenticated attackers.
Apply the latest security updates for Grafana to fix the authentication bypass vulnerability and prevent unauthorized access and deletion of snapshot data.
Technical Analysis
CVE-2021-39226 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-39226 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-39226 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1