{"id":"CVE-2026-21727","kind":"vulnerability","aliases":["CVE-2026-21727","GHSA-p5x9-j974-rpfp","GO-2026-6664"],"related":[],"title":"Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","summary":"Grafana's Correlations feature returns legacy correlation records with org_id = 0 across organizations, so a user with datasource management rights can read and permanently delete another organization's legacy correlation data. The sources rate it low (CVSS 3.3) and EPSS 0.002, with no known exploitation.","severity":"low","cvss":3.3,"epss":0.00204,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/grafana/grafana","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["grafana","multi-tenant","package","self-hosted"],"not_affected_if":["no-pre-10.2-correlations","patched-version","single-org"],"how_to_check":"Check whether any correlations were created before Grafana 10.2 (legacy org_id = 0 rows) in a multi-organization instance; the sources do not give a specific query or file.","fix":"Upgrade Grafana to 11.6.11, 12.0.9, 12.1.6, or 12.2.4 or later, matching your release line.","status":"open","published_at":"2026-04-15T20:16:34+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:20+00:00","updated_at":"2026-10-23T21:49:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:49:20Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Grafana to 11.6.11, 12.0.9, 12.1.6, or 12.2.4 or later, matching your release line.","reach":"network","impact":"medium","summary":"Grafana's Correlations feature returns legacy correlation records with org_id = 0 across organizations, so a user with datasource management rights can read and permanently delete another organization's legacy correlation data. The sources rate it low (CVSS 3.3) and EPSS 0.002, with no known exploitation.","category":"package","who_cares":["grafana","self-hosted","multi-tenant"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user reads and deletes other organizations' legacy correlation data","analyst_note":"","how_to_check":"Check whether any correlations were created before Grafana 10.2 (legacy org_id = 0 rows) in a multi-organization instance; the sources do not give a specific query or file.\nunknown","needs_analyst":false,"not_affected_if":["single-org","no-pre-10.2-correlations","patched-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000504,"input_tokens":3008,"output_tokens":406,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A,27A '-21727':17A,28A '-6664':25A '/grafana/grafana':14A,31A '0':51B,112C '0.002':81B '10.2':145C '11.6.11':150C '12.0.9':151C '12.1.6':152C '12.2.4':154C '3.3':78B 'across':52B,117C 'affect':99C,139C 'allow':4A,109C 'anoth':66B,135C 'backward':106C 'belong':133C 'compat':107C 'condit':108C 'correl':3A,42B,46B,70B,97C,101C,131C,140C 'could':125C 'creat':141C 'cross':6A,88C 'cross-ten':5A,87C 'cve':15A,26A 'cvss':77B 'data':71B,132C 'datasourc':58B,122C 'delet':10A,65B,129C 'disclosur':8A 'due':103C 'epss':80B 'exploit':85B 'featur':43B,98C 'fix':148C 'found':93C 'g2h':161C 'ghsa':19A 'ghsa-p5x9-j974-rpfp':18A 'github.com':13A,30A 'github.com/grafana/grafana':12A,29A 'go':23A 'grafana':1A,32B,40B,95C,144C 'gyu':158C 'gyu-hyeok':157C 'host':39B 'hyeok':159C 'id':50B,111C 'isol':90C 'issu':138C 'j974':21A 'known':84B 'lee':160C 'legaci':2A,45B,69B,100C,130C 'low':76B 'manag':59B,123C 'multi':34B 'multi-ten':33B 'org':49B,110C 'organ':53B,67B,118C,136C 'p5x9':20A 'packag':36B 'perman':64B,128C 'prior':142C 'privileg':124C 'rate':74B 'read':62B,126C 'record':47B,102C,113C 'report':163C 'return':44B,116C 'right':60B 'rpfp':22A 'self':38B 'self-host':37B 'sourc':73B 'tenant':7A,35B,89C 'thank':155C 'user':56B,120C 'vulner':91C,165C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-15T20:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6664","url":"https://pkg.go.dev/vuln/GO-2026-6664","severity":null,"published_at":"2026-10-07T14:10:44+00:00","modified_at":"2026-10-07T14:10:44+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-21727","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21727","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21727","severity":null,"published_at":"2026-04-15T20:16:34+00:00","modified_at":"2026-08-19T19:17:14+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}