{"id":"CVE-2026-21727","aliases":["BIT-grafana-2026-21727","CLSA-2026-1789289678","EUVD-2026-23011","GHSA-p5x9-j974-rpfp","GO-2026-6664","UBUNTU-CVE-2026-21727"],"status":"published","title":"Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00212,"percentile":0.11601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-04-15T18:57:25Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["1.9.2-0.20260127141016-e702db6096e0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.11","12.0.9","12.1.6","12.2.4","12.3.3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","fixed_in":["10.2.6-15.el9_6.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","fixed_in":["10.2.6-15.el9_6.tuxcare.els17"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260127141016-e702db6096e0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.6.11"},{"introduced":"12.0.0"},{"fixed":"12.0.9"},{"introduced":"12.1.0"},{"fixed":"12.1.6"},{"introduced":"12.2.0"},{"fixed":"12.2.4"},{"introduced":"12.3.0"},{"fixed":"12.3.3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.2-0.20260127141016-e702db6096e0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana correlations"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-21727","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21727","tags":["web","advisory"]},{"url":"https://github.com/grafana/grafana/commit/2b2847625b8a77ba47128ccb5ecbcd72542cb9bc","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/2cf0dd6fde3f5a2b92864e2376ae5378c7df45e2","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/4010ee30bb441bc399a1f37bdc8ab55ec909f3b7","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/8e7ea333991d913298bd68d4787da9c6977a0a8c","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/a9a98fc4327182d1bdb9a74b5c2938d5c127e764","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/e702db6096e0509ff2825f732697f077e9e6289f","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-p5x9-j974-rpfp","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789289678.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21727.json","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-21727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21727","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-21727","title":"Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T18:57:25.185Z","modified":"2026-08-27T17:22:44.594Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-23011","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T18:57:25Z","modified":"2026-08-27T17:22:44Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-p5x9-j974-rpfp","title":"Grafana legacy correlations allow cross-tenant disclosure and deletion","description":"---\nhero:\n  image: /static/img/heros/hero-legal2.svg\n  content: \"# Cross-Tenant Legacy Correlation Disclosure and Deletion\"\ndate: 2026-01-29\nproduct: Grafana\nfixed_versions:\n  - \"\u003e=11.6.11 \u003e=12.0.9 \u003e=12.1.6 \u003e=12.2.4\"\n---\nA cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T21:30:18Z","modified":"2026-10-05T22:33:26Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-21727","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T20:16:34.29Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"CVE-2026-21727","title":"Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T18:57:25.185Z","modified":"2026-10-28T02:30:30.540390427Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-p5x9-j974-rpfp","title":"Grafana legacy correlations allow cross-tenant disclosure and deletion","description":"---\nhero:\n  image: /static/img/heros/hero-legal2.svg\n  content: \"# Cross-Tenant Legacy Correlation Disclosure and Deletion\"\ndate: 2026-01-29\nproduct: Grafana\nfixed_versions:\n  - \"\u003e=11.6.11 \u003e=12.0.9 \u003e=12.1.6 \u003e=12.2.4\"\n---\nA cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T21:30:18Z","modified":"2026-10-07T17:55:45.029966249Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2026-21727","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-15T20:16:00Z","modified":"2026-09-02T19:35:35.556565053Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"BIT-grafana-2026-21727","title":"Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e=11.6.11, \u003e=12.0.9, \u003e=12.1.6, and \u003e=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","status":"published","published":"2026-04-21T12:04:43.119Z","modified":"2026-10-07T17:55:45.029966249Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1789289678","title":"grafana: Fix of 3 CVEs","description":"- CVE-2026-21727: drop the org_id = 0 backward-compatibility condition from the\n  correlations read and delete paths so legacy correlation records created before\n  Grafana 10.2 can no longer be read or deleted across organizations","status":"published","published":"2026-09-22T12:36:15Z","modified":"2026-10-26T09:31:34.853097494Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"GO-2026-6664","title":"Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana","description":"Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260127141016-e702db6096e0.","status":"published","published":"2026-10-07T14:10:44Z","modified":"2026-10-07T17:55:45.029966249Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}