Is CVE-2026-21727 actively exploited?

No active exploitation of CVE-2026-21727 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-21727 be exploited remotely?

Yes. CVE-2026-21727 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-21727?

CVE-2026-21727 has a CVSS score of 3.3 (LOW).

HOME VULNERABILITIESCVE-2026-21727

LOW

CVE-2026-21727

Published: April 15, 2026· Updated: Apr 20, 2026

3.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.7th

Official Description

---

title: Cross-Tenant Legacy Correlation Disclosure and Deletion

draft: false

hero:

image: /static/img/heros/hero-legal2.svg

content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion"

date: 2026-01-29

product: Grafana

severity: Low

cve: CVE-2026-21727

cvss_score: "3.3"

cvss_vector: "CVSS:3.3/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"

fixed_versions:

- ">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4"

---

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

NVD Source

Technical Analysis

CVE-2026-21727 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.