CVE-2026-13719 Overview
CVE-2026-13719 is an information disclosure vulnerability in Grafana's alert rules API list endpoint. An authenticated user can enumerate alert rules stored in folders they lack read permission for. The flaw occurs when the set of readable folders is empty, causing the folder restriction to be dropped entirely and returning every alert rule in the organization. Starting with Grafana 13.1.0, any authenticated user can trigger the condition using a folder filter parameter. The exposed information is limited to alert rule configuration; data source credentials remain protected. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Any authenticated Grafana user can enumerate alert rule configurations across the entire organization, bypassing folder-level access controls.
Affected Products
- Grafana 13.1.0 and later (any authenticated user can trigger via folder filter)
- Earlier Grafana versions where a user's readable folder set can be empty
- Grafana deployments relying on folder-based access control for alert rule isolation
Discovery Timeline
- 2026-09-30 - CVE-2026-13719 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-13719
Vulnerability Analysis
The vulnerability resides in Grafana's alert rules API list endpoint. Grafana enforces folder-scoped read permissions to restrict which alert rules a user can view. When a request is made, the backend builds a filter listing the folders the user is authorized to read. That filter is then applied to the alert rule query.
The logic fails when the readable folder set is empty. Instead of returning no results, the folder restriction is dropped from the query. The endpoint then returns every alert rule in the organization. From Grafana 13.1.0 onward, this condition is reachable by any authenticated user through supplying a folder filter parameter in the request.
Exposed data includes rule names, expressions, thresholds, evaluation intervals, labels, annotations, and notification routing metadata. Data source credentials are not exposed. Attackers can still use this information to map internal monitoring coverage, identify observability blind spots, and prepare stealthier follow-on activity.
Root Cause
The defect is a broken access control pattern where an empty allow-list is treated as "no restriction" rather than "deny all." The folder authorization filter is discarded when the permitted set is empty, inverting the intended default-deny behavior.
Attack Vector
Exploitation requires network access to the Grafana API and valid authenticated credentials with low privileges. The attacker sends a request to the alert rules list endpoint with a folder filter parameter. No user interaction is required. Refer to the Grafana Security Advisory for CVE-2026-13719 for endpoint-level detail.
Detection Methods for CVE-2026-13719
Indicators of Compromise
- Requests to the Grafana alert rules API list endpoint containing folder filter query parameters from low-privileged user accounts.
- Unusually large response payloads from the alert rules API returned to users who normally have access to few or zero folders.
- Enumeration patterns where a single authenticated session retrieves alert rule metadata spanning multiple organizational folders.
Detection Strategies
- Review Grafana access logs for API calls to the alert rules list endpoint and correlate the folder scope in the response against the requester's assigned permissions.
- Alert on authenticated sessions returning alert rules from folders the user is not a member of, using role-to-folder mapping as a reference.
- Baseline normal alert rule API request volume per user and flag statistical outliers.
Monitoring Recommendations
- Forward Grafana application and audit logs to a centralized log platform for long-term retention and correlation.
- Enable Grafana's audit logging feature and track authenticated API access to the alerting subsystem.
- Monitor for anomalous user-agent strings or scripted access patterns against the Grafana API surface.
How to Mitigate CVE-2026-13719
Immediate Actions Required
- Upgrade Grafana to a version containing the fix as documented in the Grafana Security Advisory for CVE-2026-13719.
- Audit existing user and service account permissions to confirm least-privilege access, especially for accounts with empty folder read sets.
- Rotate any secrets, thresholds, or internal identifiers that may have been exposed through alert rule definitions.
Patch Information
Grafana Labs has published a security advisory and corresponding patched releases for CVE-2026-13719. Consult the vendor advisory at grafana.com/security/security-advisories/cve-2026-13719 for the exact fixed version numbers applicable to your deployment channel.
Workarounds
- Restrict network access to the Grafana API to trusted networks or authenticated proxies where feasible.
- Assign every user at least one readable folder to avoid triggering the empty-set condition on pre-13.1.0 builds, understanding this is not a complete fix.
- Review and reduce sensitive information embedded in alert rule names, annotations, and label values until patching is complete.
# Configuration example: verify Grafana version and audit logging
grafana-server -v
# Enable audit logging in grafana.ini
# [auditing]
# enabled = true
# loggers = file
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
