High severity · published Oct 13, 2022
CVE-2022-31130
Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
< 8.5.14; >= 9.0.0, < 9.1.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31130
Patch
https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177
Patch
https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f
Release Notes
https://github.com/grafana/grafana/releases/tag/v9.1.8
Patch
https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user…
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used