What’s Vulnerable › Vulnerabilities

CVE-2022-35957: Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-20 · updated 2026-06-17
• Weakness: CWE-290

Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

Affected products

• Fedoraproject Fedora: 37
• Grafana: before 8.5.13; from 9.0.0 before 9.0.9; from 9.1.0 before 9.1.6 — fixed in 8.5.13, 9.0.9, 9.1.6

How to fix

Upgrade to a fixed version: Grafana 8.5.13, 9.0.9, 9.1.6. Check the vendor advisory for mitigations.

References

• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
• https://security.netapp.com/advisory/ntap-20221215-0001/
• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
• https://security.netapp.com/advisory/ntap-20221215-0001/

Get alerted when CVE-2022-35957 or the next vulnerability affects your stack