Every CVE Search/ Get API key

CVE-2022-31176

Grafana Image Renderer leaking files

8.3 HighFix available

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
High

Exploit likelihood

1.14%Up 0.3 points since Sep 3, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.3

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
CVE-2022-31176
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2022-52777 8.3

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
EUVD-2022-52777
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated
2026-11-02
NVD 8.3

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
CVE-2022-31176
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-200, CWE-306
Updated
2026-11-02
OSVALPINE-CVE-2022-31176 8.1

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
ALPINE-CVE-2022-31176
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSV 8.3

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
CVE-2022-31176
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Weakness
CWE-200
Updated
2026-11-02
OSVBIT-grafana-image-renderer-2022-31176 No score

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to disable HTTP remote rendering.

Record
BIT-grafana-image-renderer-2022-31176
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grafana
Alpine:v3.16
 before 8.5.11-r0
8.5.11-r0
grafana
Alpine:v3.17
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.18
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.19
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.20
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.21
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.22
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.23
 before 9.1.2-r0
9.1.2-r0
grafana
Alpine:v3.24
 before 9.1.2-r0
9.1.2-r0
grafana-image-renderer
Bitnami
 before 3.6.1
3.6.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31176 is a high vulnerability (CVSS 8.3) in Grafana Grafana-image-renderer, published September 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in grafana 8.5.11-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open