CVE-2026-81841

Paused shared dashboard access tokens still expose data source configuration

5.3 MediumFix available

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.38%Unchanged since Sep 30, 2026

What each source reports

CVE List Score used 5.3

Paused shared dashboard access tokens still expose data source configuration

Record: CVE-2026-81841
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-89456 5.3

Record: EUVD-2026-89456
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4jjr-w7m9-wx5q 5.3

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve...

Record: GHSA-4jjr-w7m9-wx5q
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 5.3

Record: CVE-2026-81841
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVALPINE-CVE-2026-81841 5.3

Record: ALPINE-CVE-2026-81841
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-04

OSVRHSA-2026:74164 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:74164
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:76430 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76448 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-81841 No score

Paused shared dashboard access tokens still expose data source configuration

Record: BIT-grafana-2026-81841
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Alpine:v3.24	before 12.4.14-r0	12.4.14-r0
`grafana` Bitnami	11.6.0 up to 12.4.12, 13.0.0 up to 13.0.10, 13.1.0 up to 13.1.7, 13.2.0 up to 13.2.3	12.4.1213.0.1013.1.713.2.3
`grafana12.4` Red Hat:hummingbird:1	before 0:12.4.12-0.2.hum1	0:12.4.12-0.2.hum1
`grafana13.2` Red Hat:hummingbird:1	before 0:13.2.3-0.1.hum1	0:13.2.3-0.1.hum1
`grafana13.1` Red Hat:hummingbird:1	before 0:13.1.7-0.1.hum1	0:13.1.7-0.1.hum1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	affected, aliases
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-81841 is a medium vulnerability (CVSS 5.3) in Grafana Enterprise, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in grafana 12.4.14-r0.

References

Show 64 moreShow less