CVE-2026-81841

Awaiting Analysis Awaiting Analysis - Queue

Paused Shared Dashboard Token Exposure in Grafana

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Grafana Labs

Description

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-81841

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	grafana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves a Grafana feature where pausing a shared dashboard does not properly revoke access tokens for frontend bootstrap data endpoints. As a result, anyone with the paused dashboard link can still retrieve dashboard configuration and stored credentials without authentication, exposing sensitive data.

Detection Guidance

Check for paused shared dashboards in Grafana that still allow access to frontend bootstrap data without authentication. Review dashboard links and tokens for unauthorized access to data source configurations.

Impact Analysis

If you use Grafana's shared dashboards, an attacker could access your dashboard's data source configurations and credentials by simply having the paused dashboard link. This could lead to unauthorized data access or breaches of connected systems.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive data or credentials without proper access controls. Unauthorized access to data sources may lead to data breaches, triggering regulatory penalties or fines.

Mitigation Strategies

Delete any paused shared dashboards to revoke access tokens. Ensure all shared dashboards are properly configured and tokens are invalidated if no longer needed.

Hi! I’m here to help you understand CVE-2026-81841. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70