CVE-2026-9703: Grafana Viewer access permits changes to Loki alerting rules
Summary
CVE-2026-9703: Authenticated users with Viewer access can change Loki alerting rules, affecting rule behavior for everyone using the configured Loki data source. Affects grafana across 3 version ranges.
>= 8.0.0, < 12.3.9
>= 12.4.0, < 12.4.6
>= 13.0.0, < 13.0.4
Fixed in 12.3.9, 12.4.6 or 13.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is a monitoring and visualization platform distributed in the Bitnami ecosystem. It connects to data sources, including Loki, and provides interfaces for users to query and manage monitoring data. Grafana's data source proxy forwards requests to configured sources, while Loki stores and applies its own alerting rules.
Vulnerability Detail
The missing role-based access control on write requests lets authenticated Grafana Viewer users create, modify, or delete Loki alerting rules through the data source proxy. The affected component is Grafana's proxy for requests to Loki's rules API. Changes are stored in Loki and affect every user of that data source. Exploitation requires a Viewer account and a configured Loki data source; Grafana OSS and Enterprise are affected, while Loki itself is not vulnerable.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 12.3.912.3.9 -
>= 12.4.0, < 12.4.612.4.6 -
>= 13.0.0, < 13.0.413.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to Grafana Viewer accounts and the data source proxy while upgrading. Review who can reach the Grafana instance and limit access to trusted users; no vendor workaround is published.
Conclusion
Upgrade Grafana to 12.3.9, 12.4.6, or 13.0.4, depending on the release line. The issue allows Viewer users to alter Loki alerting rules through Grafana's proxy, with changes affecting all users of the data source. Loki itself does not need patching. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for grafana →
FAQ
CVE-2026-9703 affects Grafana versions from 8.0.0 up to the fixed releases 12.3.9, 12.4.6, and 13.0.4 on their respective release lines.
CVE-2026-9703 lets an authenticated Grafana Viewer create, modify, or delete Loki alerting rules, changing them for all users of that data source.
Upgrade Grafana to the minimum fixed version for its release line: 12.3.9, 12.4.6, or 13.0.4.
Restrict access to Grafana Viewer accounts and the data source proxy while upgrading; no vendor-documented workaround is published.
Manually inspect the application's manifest or SBOM for Grafana. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
