CVE-2021-39226 KEVPublic exploit High · 7.3 EPSS 99.9%

Grafana Authentication Bypass Vulnerability

Summary

A flaw in Grafana's snapshot feature, part of the Grafana open source data visualization platform, lets users access and delete snapshots they should not be able to reach, through the /dashboard/snapshot/:key, /api/snapshots/:key and /api/snapshots-delete/:deleteKey paths. An unauthenticated attacker over the network can view and, if the public_mode setting is enabled, delete the lowest-keyed snapshot without any credentials or user interaction, while any authenticated user can delete it regardless of that setting, and repeated access allows a full walk through all snapshot data.

Official description · NVD

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Breakdown

68.1 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource data149 general detection rules
What they do
- Delete or destroy dataT1485 · Data DestructionSource data20 general detection rules

First seen exploited 10 months after disclosure.

Disclosed5 Oct 2021day 0
First seen exploitedVulnCheck KEV evidence19 Aug 2022+10 mo
Added to CISA KEVEU database agrees25 Aug 2022+11 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

2 related vulnerabilities in the same code over 16 months. The latest fix listed for github.com/grafana/grafana is 8.3.5.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2021-39226Grafana Authentication Bypass5 Oct 2021KEV
relatedMedium
Why these are linked:
- Same code patched: dashboard_snapshot.go (machine-matched)Functions: CreateDashboardSnapshotcommit 2d456a6 commit 239888f commit d7dcea7
CVE-2022-39324Grafana vulnerable to spoofing originalUrl of snapshots27 Jan 2023

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

7.2.1CVE-2020-1245829 Apr 2020
7.2.1CVE-2020-1245929 Apr 2020
7.4.2CVE-2021-2735818 Mar 2021
8.1.6CVE-2021-392265 Oct 2021KEV
8.2.4CVE-2021-4124415 Nov 2021
8.3.1CVE-2021-437987 Dec 2021KEV
8.3.2CVE-2021-4381510 Dec 2021
8.3.5CVE-2022-217028 Feb 2022
8.3.5CVE-2022-217138 Feb 2022Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190

MITRE CTID mapping of the KEV entry · how it is exploited

This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published. In exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the "public_mode" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss.

ImpactTA0040

Data Destruction T1485

MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 169 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-39226 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Data DestructionT148520 general rules

Fsutil Suspicious Invocationhighstable
Potential BlackByte Ransomware Activityhightest
Potential File Overwrite Via Sysinternals SDeletehightest
Renamed Sysinternals Sdelete Executionhightest
AWS EFS Fileshare Mount Modified or Deletedmediumtest
Azure Device or Configuration Modified or Deletedmediumtest
Azure Kubernetes Network Policy Changemediumtest
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest

All 20 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-69j6-29vr-p3j9

Upgrade to 8.3.10

Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-43798).

Still affected on this line by CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

Gogo get github.com/grafana/grafana@v8.3.10

First fixed in 8.1.6 for CVE-2021-39226.

Affected versions, by release line

If you run	Upgrade to
8.0.0 up to 8.1.6	8.3.10first fix for this CVE: 8.1.6
All versions before 7.5.11 Still affected on this line by CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).	7.5.11

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

9 links, grouped by NVD tag (8 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 25 Aug 2022. Federal due date 15 Sep 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 25 Aug 2022. EUVD-2021-2169

Public exploitAdvisories link exploit code.

, 30 Oct 2026

99.9%Top 0.03%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.97%).

3.1

7.3High · 7.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1534 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9997 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.3 5.1/7

End-of-life productsupported or unknown 0.0

Total68.1

Record

Published: 5 Oct 2021
Modified: 17 Jun 2026
: CWE-862 Missing AuthorizationCWE-287 Improper Authentication
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 1

US Government Resource 1

Third Party Advisory 2

Release Notes 2

Broken Link 2

How attackers get in

What they do

techniques