CVE-2026-13720

Editor can forge file-provisioning provenance on dashboards via the dashboard API

5.4 MediumFix available

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.16%Unchanged since Oct 1, 2026

What each source reports

CVE List Score used 5.4

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Record: CVE-2026-13720
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-285, CWE-915, CWE-345
Updated: 2026-11-02

EUVDEUVD-2026-89775 5.4

Record: EUVD-2026-89775
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9q62-r26p-xcjv 5.4

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId...

Record: GHSA-9q62-r26p-xcjv
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-285
Updated: 2026-11-02

NVD 5.4

Record: CVE-2026-13720
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-285, CWE-345, CWE-915
Updated: 2026-11-02

OSVALPINE-CVE-2026-13720 5.4

Record: ALPINE-CVE-2026-13720
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-04

OSVRHSA-2026:74164 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:74164
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2026:76430 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76448 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-13720 No score

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Record: BIT-grafana-2026-13720
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Alpine:v3.24	before 12.4.14-r0	12.4.14-r0
`grafana` Bitnami	12.0.0 up to 12.4.12, 13.0.0 up to 13.0.10, 13.1.0 up to 13.1.7, 13.2.0 up to 13.2.3	12.4.1213.0.1013.1.713.2.3
`grafana12.4` Red Hat:hummingbird:1	before 0:12.4.12-0.2.hum1	0:12.4.12-0.2.hum1
`grafana13.2` Red Hat:hummingbird:1	before 0:13.2.3-0.1.hum1	0:13.2.3-0.1.hum1
`grafana13.1` Red Hat:hummingbird:1	before 0:13.1.7-0.1.hum1	0:13.1.7-0.1.hum1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13720 is a medium vulnerability (CVSS 5.4) in Grafana Enterprise, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in grafana 12.4.14-r0.

References

Show 64 moreShow less