CVE record · 1 source
CVE-2026-9703
CVSS 7.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.
- Vendor
- Grafana Labs
- Product
- Grafana / Loki / Tempo / Mimir
- CVSS
- 7.1
- Exposure class
- Network management
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests…