What’s Vulnerable › Vulnerabilities
CVE-2024-8118: Grafana alerting wrong permission on datasource rule write endpoint
- Severity: medium (CVSS 5.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-26 · updated 2026-06-17
- Weakness: CWE-653
Description
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
Affected products
- Grafana: from 8.5.0 before 10.3.10; from 10.4.0 before 10.4.9; from 11.0.0 before 11.0.5; from 11.1.0 before 11.1.6; from 11.2.0 before 11.2.1 — fixed in 10.3.10, 10.4.9, 11.0.5, 11.1.6, 11.2.1
How to fix
Upgrade to a fixed version: Grafana 10.3.10, 10.4.9, 11.0.5, 11.1.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-8118 or the next vulnerability affects your stack