Vulnerability record · CVE-2021-39226 · published 5 October 2021
CVE-2021-39226: Grafana snapshot endpoints allow unauthenticated view and delete
Grafana · Grafana
Grafana exposes snapshot endpoints that resolve to the snapshot with the lowest database key when accessed via literal paths such as /dashboard/snapshot/:key, /api/snapshots/:key and /api/snapshots-delete/:deleteKey. Unauthenticated users can view that snapshot, and can delete it when public_mode is enabled; authenticated users can delete it regardless of that setting. Combined viewing and deletion lets an attacker walk through all snapshot data while destroying it, and the flaw is listed in CISA KEV with a very high EPSS score.
Description
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Automated analysis
critical priorityThe flaw allows unauthenticated data exposure and deletion, is listed in CISA KEV, and has an EPSS probability near 1.0.
What it is
Grafana exposes snapshot endpoints that resolve to the snapshot with the lowest database key when accessed via literal paths such as /dashboard/snapshot/:key, /api/snapshots/:key and /api/snapshots-delete/:deleteKey. Unauthenticated users can view that snapshot, and can delete it when public_mode is enabled; authenticated users can delete it regardless of that setting. Combined viewing and deletion lets an attacker walk through all snapshot data while destroying it, and the flaw is listed in CISA KEV with a very high EPSS score.
Impact
An attacker can read snapshot contents without authentication and delete snapshots, causing loss of snapshot data; the CVSS vector rates confidentiality, integrity and availability impact as low each.
Attack surface
Reachable over the network through the Grafana HTTP endpoints listed in the advisory; no authentication is required for viewing, and deletion requires either authentication or public_mode set to true. No user interaction is needed per the CVSS vector.
Exploitation
CVE-2021-39226 is in CISA KEV (added 2022-08-25) and has an EPSS 30-day probability of 0.99933, indicating active exploitation is expected; the vendor advisory reference is tagged Exploit.
What to do
- Upgrade Grafana to 8.1.6 or 7.5.11, which resolve the issue.
- If upgrading is not possible, block the literal paths /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key and /api/snapshots/:key at a reverse proxy.
- Keep the snapshot public_mode setting at its default of false.
- Review and remove any snapshots that should not be retained, since the endpoints have no normal function and can be disabled without side effects.
Detection
- Monitor web logs for requests to /dashboard/snapshot/:key, /api/snapshots/:key and /api/snapshots-delete/:deleteKey, especially with literal or sequential keys.
- Alert on snapshot deletion events and on access to snapshot endpoints by unauthenticated clients.
- Audit Grafana snapshot inventory for unexpected loss or gaps in database keys.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-39226 to the Known Exploited Vulnerabilities catalog on 25 August 2022 as "Grafana Authentication Bypass Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 September 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-39226 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-39226), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
