GHSA-3q27-7qjq-p9c5
Grafana public dashboards disclose all direct mode datasources
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/grafana/grafana | < 11.6.14 | no fix listed |
| Go | github.com/grafana/grafana | < 12.1.10 | no fix listed |
| Go | github.com/grafana/grafana | < 12.2.8 | no fix listed |
| Go | github.com/grafana/grafana | < 12.3.6 | no fix listed |
| Go | github.com/grafana/grafana | < 12.4.2 | no fix listed |
| Go | github.com/grafana/grafana | >= 1.9.2-0.20221116104934-4ee83a5f2bf4, < 1.9.2-0.20260325055210-3522153e07b4 | 1.9.2-0.20260325055210-3522153e07b4 |
Details
As written in the advisory (Markdown source, shown as plain text).
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
References
External links from the advisory. They lead to third-party sites.