The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana | Nov 16, 2023 | Oct 13, 2022 |
| Centos_linux | — | Upgrade grafana-debuginfoUpgrade grafana-debugsourceUpgrade grafana | Nov 8, 2023 | Oct 13, 2022 |
| Freebsd | — | Upgrade grafana8Upgrade grafanaUpgrade grafana9Upgrade grafana7 | Nov 13, 2022 | Nov 12, 2022 |
| Oracle_linux | — | Upgrade grafana | Nov 16, 2023 | Oct 14, 2022 |
| Redhat_linux | — | Upgrade grafana-debuginfoNo solution existsUpgrade grafanaUpgrade grafana-debugsource | Nov 8, 2023 | Oct 13, 2022 |
| Suse | — | Upgrade grafanaUpgrade spacecmdUpgrade dracut-saltboot | Feb 13, 2023 | Oct 13, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 13, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub