CVE-2021-27358: Denial of service in Grafana
Summary
CVE-2021-27358: Denial of service in Grafana. Affects github.com/grafana/grafana versions >= 6.7.3, < 7.4.2. Fixed in 7.4.2. How to fix ↓
Also tracked for
- grafana · Bitnami
The same CVE-2021-27358 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources. It provides a flexible and customizable interface for creating dashboards, graphs, and alerts. The affected package, github.com/grafana/grafana/pkg/middleware, is a middleware component used by Grafana to handle HTTP requests and perform various functions such as authentication and authorization. This vulnerability affects versions prior to 7.4.2 of Grafana.
Vulnerability Detail
The snapshot feature in Grafana before 7.4.2 can be exploited by unauthenticated remote attackers to trigger a Denial of Service (DoS) attack. This can be achieved by making a remote API call with a specific configuration. If the targeted Grafana instance has a commonly used configuration, the DoS attack can be triggered. The impact of this vulnerability can result in the unavailability of the Grafana service, affecting its functionality and potentially disrupting monitoring and analytics operations.
How To Fix
Latest published version: v6.1.6+incompatible as of 22 Oct 2026
go get github.com/grafana/grafana@v6.1.6+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.2
This is the first release that contains the fix.
go get github.com/grafana/grafana@v7.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, it is recommended to disable or restrict access to the snapshot feature in Grafana. This can be achieved by modifying the configuration or access control settings to prevent unauthenticated or unauthorized users from accessing the snapshot functionality. Implementing proper access controls and regularly monitoring the Grafana instance can help mitigate the risk of exploitation.
Conclusion
In conclusion, the vulnerability in Grafana's snapshot feature can be exploited to trigger a Denial of Service attack. It is crucial to upgrade to the latest version of Grafana (7.4.2 or later) to mitigate this vulnerability. Additionally, implementing proper access controls and monitoring can help reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/grafana/grafana →
FAQ
Grafana is an open-source analytics and monitoring platform used to visualize and analyze data from various sources.
The snapshot feature in Grafana allows users to capture and share snapshots of dashboards and graphs.
The vulnerability can be exploited by making a remote API call with a specific configuration, triggering a DoS attack if the targeted Grafana instance has a commonly used configuration.
The vulnerability can result in a Denial of Service, rendering the Grafana service unavailable and potentially disrupting monitoring and analytics operations.
To fix this vulnerability, it is recommended to upgrade Grafana to version 7.4.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/grafana/grafana.
