CVE-2018-15727: Authentication Bypass in Grafana
Summary
CVE-2018-15727: Grafana Authentication Bypass. Affects github.com/grafana/grafana across 2 version ranges.
< 4.6.4
>= 5.0.0, < 5.2.3
Fixed in 4.6.4 or 5.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources. It provides a user-friendly interface for creating and managing dashboards, graphs, and alerts. The affected package in this vulnerability is 'github.com/grafana/grafana/pkg/api' in the Go ecosystem.
Vulnerability Detail
The vulnerability, identified as CVE-2018-15727, is an authentication bypass issue in Grafana versions before 4.6.4 and 5.x before 5.2.3. It allows an attacker to bypass authentication by generating a valid 'remember me' cookie using only the username of an LDAP or OAuth user. This means that an unauthorized user can gain access to the Grafana interface and perform actions on behalf of the authenticated user. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: v6.1.6+incompatible as of 22 Oct 2026
go get github.com/grafana/grafana@v6.1.6+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.6.44.6.4go get github.com/grafana/grafana@v4.6.4 -
>= 5.0.0, < 5.2.35.2.3go get github.com/grafana/grafana@v5.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of Grafana to mitigate the risk of authentication bypass.
Conclusion
In conclusion, CVE-2018-15727 is a critical authentication bypass vulnerability in Grafana. It allows an attacker to bypass authentication and gain unauthorized access to the Grafana interface. To mitigate this vulnerability, it is crucial to upgrade Grafana to the fixed versions mentioned. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/grafana/grafana →
FAQ
Grafana is an open-source analytics and monitoring platform used for visualizing and analyzing data from various sources.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to the Grafana interface, potentially performing actions on behalf of authenticated users.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade Grafana to version 4.6.4 or higher (for versions before 5.x) or version 5.2.3 or higher (for versions 5.x).
There is no known workaround for this vulnerability. Upgrading to the fixed versions of Grafana is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/grafana/grafana.
