CVE-2020-13379: Server Side Request Forgery in Grafana
Summary
CVE-2020-13379: Server Side Request Forgery in Grafana. Affects github.com/grafana/grafana across 2 version ranges.
>= 3.0.1, < 6.7.4
>= 7.0.0, < 7.0.2
Fixed in 6.7.4 or 7.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- grafana · Bitnami
The same CVE-2020-13379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources. It provides a web-based interface for creating and managing dashboards, graphs, and alerts. The avatar feature in Grafana versions 3.0.1 through 7.0.1 is affected by a Server Side Request Forgery (SSRF) vulnerability. This vulnerability allows any unauthenticated user or client to make Grafana send HTTP requests to any URL and return the result. This can be exploited to gain information about the network Grafana is running on.
Vulnerability Detail
The SSRF vulnerability in Grafana's avatar feature arises from an incorrect access control issue. It enables remote code execution, posing a significant security risk. Attackers can exploit this vulnerability to send arbitrary HTTP requests from the Grafana server to external resources, potentially leading to unauthorized access, data leakage, or further compromise of the system. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: v6.1.6+incompatible as of 22 Oct 2026
go get github.com/grafana/grafana@v6.1.6+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.1, < 6.7.46.7.4go get github.com/grafana/grafana@v6.7.4 -
>= 7.0.0, < 7.0.27.0.2go get github.com/grafana/grafana@v7.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable the avatar feature in Grafana until the system can be updated to a fixed version. This can be achieved by modifying the Grafana configuration to remove or comment out the avatar-related settings. Here is an example of how to disable the avatar feature in the Grafana configuration file:
[users]
avatar_url =
[auth]
disable_gravatar = true
By making these changes, the SSRF vulnerability can be mitigated until the upgrade is performed.
Conclusion
The SSRF vulnerability in Grafana's avatar feature poses a significant security risk, allowing remote code execution and potential unauthorized access to external resources. It is crucial to upgrade to a fixed version of Grafana to mitigate this vulnerability. In the meantime, disabling the avatar feature can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/grafana/grafana →
FAQ
Grafana is an open-source analytics and monitoring platform used for visualizing and analyzing data from various sources.
The avatar feature in Grafana allows users to associate profile pictures or avatars with their accounts.
Server Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make a server perform arbitrary HTTP requests on their behalf.
This vulnerability can be exploited to gain unauthorized access, leak sensitive information, or further compromise the system.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/grafana/grafana.
