CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.

Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.

The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v0.0.0-20250424191517-1f707d16ed5d.

These are all security issues fixed in the grafana-11.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• Update to version 11.6.11: Features and enhancements:

  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

• Update to version 11.6.10: Features and enhancements:

  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID

• Update to version 11.6.9: Features and enhancements:

  • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
  • Alerting: Fix contacts point issues

• Update to version 11.6.8: Bug fixes:

  • Alerting: Fix unmarshalling of GettableStatus to include time intervals

• Update to version 11.6.7: Bug fixes:

  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

• Update to version 11.6.6: Bug fixes:

  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath

• Update to version 11.6.5: Features and enhancements:

  • Alerting: Bump alerting package to include change to NewTLSClient

• Update to version 11.6.4: Features and enhancements:

  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows

• Update to version 11.6.3: Security:

  • Fixes CVE-2025-3415

• Update to version 11.6.2: Bug fixes:

  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path

• Update to version 11.6.1: Features and enhancements:

  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs

• Upgrade to version 11.6.0: Features and enhancements:

  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history Security:
  • API keys: Migrate API keys to service accounts at startup

• CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

• CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

• CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

• CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

• Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

• Update to version 11.5.10: Security:

  • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
  • Update to Go 1.25
  • Update to golang.org/x/net v0.45.0 Bug fixes:
  • Auth: Fix render user OAuth…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.15.2
  • SUSE Manager 4.3 will transition to LTS after June 2025
  • CVE Fixed CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339 CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870 CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454 CVE-2025-3580, CVE-2025-4123, CVE-2024-47535

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

• Security issues fixed:

  • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

• Other bugs fixes from version 2.53.4:

  • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
  • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

• Security issues fixed:

  • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

• Other changes from version 0.26.0:

  • Changes:
    • Replace go-kit/log with log/slog module.
  • Features:
    • Add metric to record tls ciphersuite negotiated during handshake.
    • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement:
    • Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes:
    • Only register grpc TLS metrics on successful handshake.

• Other changes from version 0.25.0:

  • Features:
    • Allow to get Probe logs by target.
    • Log errors from probe.
  • Bug fixes:
    • Prevent logging confusing error message.
    • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

golang-github-prometheus-node_exporter was updated to version 1.9.1:

• Security issues fixed:

  • CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)

• Other changes from version 1.9.1: …

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

• Security issues fixed:

  • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

• Other bugs fixes from version 2.53.4:

  • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
  • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

• Security issues fixed:

  • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

• Other changes from version 0.26.0:

  • Changes:
    • Replace go-kit/log with log/slog module.
  • Features:
    • Add metric to record tls ciphersuite negotiated during handshake.
    • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement:
    • Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes:
    • Only register grpc TLS metrics on successful handshake.

• Other changes from version 0.25.0:

  • Features:
    • Allow to get Probe logs by target.
    • Log errors from probe.
  • Bug fixes:
    • Prevent logging confusing error message.
    • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

This update for grafana fixes the following issues:

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/