CVE-2022-39328: Grafana vulnerable to race condition allowing privilege escalation

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-08 · updated 2026-06-17
Weakness: CWE-362

Description

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.

Affected products

Grafana: from 9.2.0 before 9.2.4 — fixed in 9.2.4

How to fix

Upgrade to a fixed version: Grafana 9.2.4. Check the vendor advisory for mitigations.

References

https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch
https://security.netapp.com/advisory/ntap-20221215-0003/
https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch
https://security.netapp.com/advisory/ntap-20221215-0003/

Get alerted when CVE-2022-39328 or the next vulnerability affects your stack