CVE-2026-19197 Overview
CVE-2026-19197 is a broken access control vulnerability [CWE-862] in Grafana affecting dashboard snapshot management. A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance. The same flaw allows an attacker to recover a snapshot's secret delete key using only its public share key. The issue stems from missing authorization checks on snapshot endpoints. Grafana published a security advisory tracking this issue under CVE-2026-19197.
Critical Impact
An authenticated organization administrator on a multi-tenant Grafana instance can delete snapshots owned by other organizations and recover snapshot delete keys from public share keys, breaking tenant isolation.
Affected Products
- Grafana (multi-tenant instances hosting multiple organizations)
- Grafana dashboard snapshot feature
- Refer to the Grafana Security Advisory CVE-2026-19197 for the exact affected version ranges
Discovery Timeline
- 2026-08-26 - CVE CVE-2026-19197 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-19197
Vulnerability Analysis
The vulnerability is a broken access control flaw affecting the Grafana dashboard snapshot subsystem. Grafana supports multi-tenant deployments where multiple organizations share a single instance. Each organization should only manage its own snapshots. This flaw breaks that isolation in two distinct ways.
First, an authenticated user holding the organization administrator role can invoke the snapshot deletion endpoint against a snapshot that belongs to a different organization. The endpoint fails to verify that the requesting administrator's organization owns the target snapshot. The result is unauthorized deletion of another tenant's data.
Second, the snapshot public share key can be used to derive or retrieve the secret delete key. The secret delete key is intended to authorize snapshot removal without user authentication. Exposing it through the public identifier collapses the security boundary between sharing a snapshot and controlling its lifecycle.
Root Cause
The root cause is missing authorization enforcement on snapshot endpoints [CWE-862]. The affected handlers do not validate cross-organization ownership before performing a delete operation, and the mapping between the public share key and the secret delete key does not require additional authentication.
Attack Vector
The attack requires network access to the Grafana API and low-privilege authentication as an organization administrator. No user interaction is needed. Exploitation involves sending crafted requests to the snapshot API using identifiers of snapshots owned by other organizations, or supplying a known public share key to retrieve the associated secret delete key. See the Grafana Security Advisory CVE-2026-19197 for the exact request paths and parameters.
Detection Methods for CVE-2026-19197
Indicators of Compromise
- Unexpected deletion of dashboard snapshots reported by organization owners.
- Grafana audit log entries showing snapshot delete operations initiated by users belonging to a different organization than the snapshot owner.
- API access patterns where a single authenticated user enumerates or references snapshot keys across multiple organization IDs.
Detection Strategies
- Enable and centralize Grafana audit logging, and alert on snapshot delete operations where the actor's orgId differs from the snapshot's owning orgId.
- Baseline normal snapshot API traffic per organization and flag deviations in delete request volume or cross-organization identifier access.
- Correlate Grafana access logs with identity provider events to attribute cross-tenant snapshot activity to specific accounts.
Monitoring Recommendations
- Monitor requests to snapshot API paths, including delete endpoints and public share key lookups, and retain them for forensic review.
- Track the population of users holding organization administrator roles on shared Grafana instances and review changes.
- Ingest Grafana logs into a centralized analytics platform to enable cross-tenant correlation and long-term retention.
How to Mitigate CVE-2026-19197
Immediate Actions Required
- Review the Grafana Security Advisory CVE-2026-19197 and identify whether your Grafana version is affected.
- Apply the fixed Grafana release for your deployment channel as documented in the advisory.
- Audit existing dashboard snapshots and rotate or regenerate snapshots that contain sensitive data shared via public keys.
- Reduce the number of accounts holding organization administrator roles on multi-tenant Grafana instances.
Patch Information
Grafana Labs has published fixed versions and remediation guidance in the Grafana Security Advisory CVE-2026-19197. Upgrade to a patched release for your Grafana distribution, including self-hosted OSS, Enterprise, and container images. Grafana Cloud tenants are patched by the vendor.
Workarounds
- Where upgrading is not immediately possible, restrict network access to the Grafana snapshot API using a reverse proxy or web application firewall rules.
- Disable the public snapshot sharing feature in Grafana configuration if it is not required by your users.
- Segregate tenants by deploying separate Grafana instances per organization rather than sharing a single multi-tenant instance.
# Configuration example: disable external snapshot sharing in grafana.ini
[snapshots]
external_enabled = false
public_mode = false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
