Live › vulnerability › CVE-2026-21727
Go to dashboardGrafana's Correlations feature returns legacy correlation records with org_id = 0 across organizations, so a user with datasource management rights can read and permanently delete another organization's legacy correlation data. The sources rate it low (CVSS 3.3) and EPSS 0.002, with no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/grafana/grafana | go | all versions | – |
Check whether any correlations were created before Grafana 10.2 (legacy org_id = 0 rows) in a multi-organization instance; the sources do not give a specific query or file.
Upgrade Grafana to 11.6.11, 12.0.9, 12.1.6, or 12.2.4 or later, matching your release line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-21727")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.