CVE-2026-17183: Grafana Authorization Bypass Vulnerability

CVE-2026-17183 Overview

CVE-2026-17183 is an authorization bypass vulnerability in Grafana affecting the alert rule subsystem. An authenticated user with permission to create or edit alert rules can bypass datasource query authorization. The attacker marks an alert rule query as a server-side expression while referencing a real datasource unique identifier (UID). Grafana processes the query using the referenced datasource credentials without enforcing the caller's datasource permissions. This exposes data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource. The flaw is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated low-privilege users with alert rule edit rights can read data from datasources they are not authorized to query, breaking Grafana's tenant and role-based access boundaries.

Affected Products

Grafana (see Grafana Security Advisory for exact affected versions)
Grafana deployments using alert rules with server-side expressions
Grafana instances with multiple datasources gated by per-user permissions

Discovery Timeline

2026-08-19 - CVE-2026-17183 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-17183

Vulnerability Analysis

Grafana alert rules support two query types: standard datasource queries and server-side expressions. Server-side expressions perform math and reduction operations on results returned by other queries. They are not expected to require datasource-level authorization because they operate on already-fetched data.

The authorization logic assumes that any query flagged as a server-side expression does not touch a real datasource. When the authorization layer sees the expression flag, it skips the datasource permission check. However, the query executor still honors the datasourceUid field on the payload. An authenticated user can submit a query that carries both the expression type marker and a real datasource UID. The permission check is bypassed, but the executor forwards the query to the referenced datasource using Grafana's stored credentials.

The vulnerability requires only alert rule create or edit permission, which is commonly granted to editors and team members who should not have universal datasource access. Exploitation is performed over the network against the Grafana HTTP API.

Root Cause

The root cause is a type-versus-target inconsistency in the alert rule query handler. Authorization decisions are made based on the declared query type (expression), while query dispatch is made based on the datasourceUid value. The two decisions are not cross-validated, so a mismatched combination bypasses the access control gate.

Attack Vector

An attacker authenticates to Grafana with an account that holds alert rule editing rights. The attacker creates or edits an alert rule and crafts a query object whose type is a server-side expression, but whose datasourceUid points to a restricted datasource such as a production database or cloud metrics backend. The rule is evaluated and results are returned in the alert preview or evaluation output, exposing rows or metrics that the attacker cannot reach through the normal Explore or dashboard interfaces.

See the Grafana Security Advisory for technical details and reproduction steps.

Detection Methods for CVE-2026-17183

Indicators of Compromise

Alert rule definitions that combine an expression query type with a populated datasourceUid referencing a real backend datasource.
Alert rule create or update API calls from user accounts that lack direct query permission on the referenced datasource.
Unexpected query traffic from the Grafana service account to sensitive datasources originating from alert rule evaluations.

Detection Strategies

Audit the Grafana database or provisioning files for alert rules where model.type is __expr__ or similar and datasourceUid is not the expression datasource UID.
Correlate Grafana audit logs for alerting.rule.create and alerting.rule.update events with the identities that own the referenced datasources.
Baseline datasource query volume per user and flag alert-rule-driven queries that touch datasources outside the user's assigned scope.

Monitoring Recommendations

Enable Grafana audit logging and forward events to a central analytics platform for retention and correlation.
Alert on any alert rule payload that fails schema validation for expression queries, including a non-expression datasourceUid.
Review datasource credentials for signs of use outside expected dashboards, folders, or alerting jobs.

How to Mitigate CVE-2026-17183

Immediate Actions Required

Upgrade Grafana to the fixed release listed in the Grafana Security Advisory as soon as it applies to your deployment channel.
Inventory user and team permissions that grant alert rule create or edit rights and remove them from accounts that do not require alerting.
Rotate credentials for any datasource that stores sensitive data if unauthorized alert rule activity is found in audit logs.

Patch Information

Grafana Labs has published a security advisory for CVE-2026-17183 with fixed versions and upgrade guidance. Refer to the Grafana Security Advisory for the exact fixed version numbers that correspond to your release train (OSS, Enterprise, or Cloud).

Workarounds

Restrict the Editor role and any custom role that includes alert.rules:write to trusted users only until the patch is applied.
Use fine-grained access control to scope alert rule permissions to specific folders that reference only datasources the users are already authorized to query.
On Grafana Cloud, confirm with Grafana Labs that the managed instance has received the fix; no customer action is required beyond permission review.

bash

# Example: list Grafana users with alert rule write permission via the HTTP API
curl -s -H "Authorization: Bearer $GRAFANA_TOKEN" \
  "https://grafana.example.com/api/access-control/users/permissions/search?action=alert.rules:write"