Medium severity · published Aug 4, 2025
CVE-2025-8341
SSRF in Infinity Datasource Plugin
5.0
CVSS
0.3%
EPSS
No
On KEV
Description
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.
If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
0.6.0 before 3.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8341
github.com
https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1
grafana.com
https://grafana.com/security/security-advisories/cve-2025-8341/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim