CVE-2026-13719

Alert rules in restricted folders disclosed via the alert rules list API

4.3 MediumFix available

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.24%Down 0.1 points since Oct 1, 2026

What each source reports

CVE List Score used 4.3

Alert rules in restricted folders disclosed via the alert rules list API

Record: CVE-2026-13719
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-863, CWE-200
Updated: 2026-11-02

EUVDEUVD-2026-89774 4.3

Record: EUVD-2026-89774
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-46f2-3vm3-9h7j 4.3

An authenticated user can list alert rules stored in folders they are not allowed to read through...

Record: GHSA-46f2-3vm3-9h7j
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 4.3

Record: CVE-2026-13719
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200, CWE-863
Updated: 2026-11-02

OSVALPINE-CVE-2026-13719 4.3

Record: ALPINE-CVE-2026-13719
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-04

OSVRHSA-2026:74164 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:74164
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:76430 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76448 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-13719 No score

Alert rules in restricted folders disclosed via the alert rules list API

Record: BIT-grafana-2026-13719
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Alpine:v3.24	before 12.4.14-r0	12.4.14-r0
`grafana` Bitnami	12.3.0 up to 12.4.12, 13.0.0 up to 13.0.10, 13.1.0 up to 13.1.7, 13.2.0 up to 13.2.3	12.4.1213.0.1013.1.713.2.3
`grafana12.4` Red Hat:hummingbird:1	before 0:12.4.12-0.2.hum1	0:12.4.12-0.2.hum1
`grafana13.2` Red Hat:hummingbird:1	before 0:13.2.3-0.1.hum1	0:13.2.3-0.1.hum1
`grafana13.1` Red Hat:hummingbird:1	before 0:13.1.7-0.1.hum1	0:13.1.7-0.1.hum1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13719 is a medium vulnerability (CVSS 4.3) in Grafana Enterprise, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in grafana 12.4.14-r0.

References

Show 64 moreShow less