CVE-2026-22641
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | grafana | 11.5.0 |
| grafana | grafana | From 11.3.8 (inc) to 12.0.2 (inc) |
| sick_ag | sick_incoming_goods_suite | From 1.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Grafana's datasource proxy API allows attackers to bypass authorization checks by inserting an extra slash character in the URL path. This flaw enables users with minimal permissions to gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. It mainly affects datasources that enforce route-specific permissions, such as Alertmanager and certain Prometheus-based datasources.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized read access to sensitive data from Alertmanager and Prometheus datasources by users who should have limited permissions. This unauthorized access could expose monitoring data or alerts that are meant to be restricted, potentially compromising operational security or revealing sensitive system information.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include restricting network access to the affected Grafana datasource proxy API, especially limiting access to Alertmanager and Prometheus datasources. Implement network segmentation and access controls to reduce exposure. Monitor and filter HTTP requests to detect and block URL paths containing extra slash characters that could bypass authorization checks. Additionally, apply any available patches or updates from Grafana that address this issue once released. Following best practices for network security such as using firewalls, VPNs, and strict access controls is recommended to reduce attack surface. [5]