CVE-2026-15815
CVE-2026-15815 CVE Record
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
CVE-2026-15815 CVE Record
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
CVE-2026-15815- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-59, CWE-94, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-82472
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
EUVD-2026-82472- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xp8x-3q7w-cpqr
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin...
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
GHSA-xp8x-3q7w-cpqr- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
CVE-2026-15815- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-59, CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-15815
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
ALPINE-CVE-2026-15815- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVRHSA-2026:83544
Red Hat Security Advisory: grafana security update
- Record
RHSA-2026:83544- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRLSA-2026:83544
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
- grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:83544- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:83544 No score
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
- grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:83544- Updated
- 2026-11-02
OSVBIT-grafana-2026-15815 No score
CVE-2026-15815 CVE Record
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.
- Record
BIT-grafana-2026-15815- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11920-1 No score
grafana-12.4.11-1.1 on GA media
These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11920-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
grafanaAlpine:v3.24 |
before 12.4.14-r0 | 12.4.14-r0 |
grafanaAlmaLinux:8 |
before 9.2.10-35.el8_10 | 9.2.10-35.el8_10 |
grafana-selinuxAlmaLinux:8 |
before 9.2.10-35.el8_10 | 9.2.10-35.el8_10 |
grafanaBitnami |
11.6.0 up to 12.0.1, 12.1.0 up to 12.1.1, 12.2.0 up to 12.2.1, 12.3.0 up to 12.3.1, 12.4.0 up to 12.4.11, 13.0.0 up to 13.0.9, 13.1.0 up to 13.1.6, 13.2.0 up to 13.2.2 | 12.0.112.1.112.2.112.3.112.4.1113.0.913.1.613.2.2 |
grafanaRed Hat:enterprise_linux:8::appstream |
before 0:9.2.10-35.el8_10 | 0:9.2.10-35.el8_10 |
grafana-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:9.2.10-35.el8_10 | 0:9.2.10-35.el8_10 |
grafana-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:9.2.10-35.el8_10 | 0:9.2.10-35.el8_10 |
grafana-selinuxRed Hat:enterprise_linux:8::appstream |
before 0:9.2.10-35.el8_10 | 0:9.2.10-35.el8_10 |
grafanaRocky Linux:8 |
before 0:9.2.10-35.el8_10 | 0:9.2.10-35.el8_10 |
grafanaopenSUSE:Tumbleweed |
before 12.4.11-1.1 | 12.4.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-15815 is a high vulnerability (CVSS 8.8) in Grafana Enterprise, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in grafana 12.4.14-r0.
References
grafana.com/security/security-advisories/cve-2026-15815
nvd.nist.gov/vuln/detail/CVE-2026-15815
github.com/advisories/GHSA-xp8x-3q7w-cpqr
security.alpinelinux.org/vuln/CVE-2026-15815
access.redhat.com/errata/RHSA-2026:83544
Show 15 moreShow less
bugzilla.redhat.com/2527474
errata.almalinux.org/8/ALSA-2026-83544.html
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83544.json
cve.org/CVERecord?id=CVE-2026-15815
errata.rockylinux.org/RLSA-2026:83544
suse.com/security/cve/CVE-2026-15815