CVE-2026-21722: Public Dashboard Information Disclosure

CVE-2026-21722 Overview

CVE-2026-21722 is an information disclosure vulnerability affecting Grafana's public dashboard feature. Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This allows an attacker to read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

While this vulnerability did not leak any annotations that would not otherwise be visible on the public dashboard, it exposes historical annotation data that administrators may have intended to restrict through timerange locking.

Critical Impact

Unauthorized access to historical annotation data on public Grafana dashboards beyond the intended locked timerange, potentially exposing sensitive operational information or notes added by internal teams.

Affected Products

• Grafana (specific versions not disclosed in CVE data - see vendor advisory)

Discovery Timeline

• 2026-02-12 - CVE CVE-2026-21722 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-21722

Vulnerability Analysis

This vulnerability represents an information leakage issue in Grafana's public dashboard functionality. When administrators create public dashboards, they can lock the timerange to restrict what data viewers can access. However, the annotation retrieval mechanism failed to respect this locked timerange constraint.

The vulnerability exists in how Grafana handles annotation queries for public dashboards. When a user requests annotations for a public dashboard, the backend should enforce the same timerange restrictions applied to the dashboard data. Instead, the annotation API returned the complete annotation history for the dashboard, regardless of the locked timerange settings.

This is classified as an information disclosure vulnerability where access controls are improperly enforced on a specific data type (annotations) while being correctly applied to other dashboard data.

Root Cause

The root cause stems from insufficient access control enforcement on the annotation retrieval endpoint when serving public dashboards. The timerange validation logic that was applied to dashboard panel data queries was not consistently applied to the annotation query pathway. This oversight allowed the annotation API to return data outside the authorized viewing window.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker with access to a public Grafana dashboard URL can manipulate annotation query parameters to retrieve historical annotations beyond the dashboard's locked timerange.

The exploitation is straightforward:

1. An attacker identifies a public Grafana dashboard with annotations enabled
2. The attacker crafts annotation API requests with expanded timerange parameters
3. The server returns annotation data from outside the locked timerange
4. The attacker can access historical annotation information that administrators intended to restrict

For detailed technical information about this vulnerability, refer to the Grafana Security Advisory.

Detection Methods for CVE-2026-21722

Indicators of Compromise

• Unusual annotation API requests targeting public dashboards with timerange parameters outside normal bounds
• Elevated volume of annotation queries for public dashboard endpoints
• API access logs showing annotation requests with extended historical timeranges
• Requests to annotation endpoints from unexpected IP addresses or user agents

Detection Strategies

• Monitor Grafana access logs for annotation API calls to public dashboards with suspicious timerange parameters
• Implement anomaly detection on API request patterns for public dashboard endpoints
• Review audit logs for bulk annotation data retrieval attempts
• Configure alerting on annotation endpoint access patterns that deviate from normal dashboard viewing behavior

Monitoring Recommendations

• Enable detailed logging for public dashboard annotation API endpoints
• Set up alerts for annotation queries with timeranges significantly exceeding dashboard lock settings
• Monitor for reconnaissance patterns such as iterative timerange expansion attempts
• Implement rate limiting on annotation API endpoints for public dashboards

How to Mitigate CVE-2026-21722

Immediate Actions Required

• Review all public dashboards with annotations enabled to assess exposure
• Temporarily disable annotations on public dashboards if sensitive information may be exposed
• Apply the latest Grafana security patches as soon as available
• Audit annotation content on public dashboards for sensitive information that may have been exposed

Patch Information

Grafana has released security updates to address this vulnerability. Administrators should update to the patched version as outlined in the official Grafana Security Advisory for CVE-2026-21722.

Workarounds

• Disable annotations on public dashboards until patches can be applied
• Remove sensitive information from annotations on dashboards that must remain public
• Restrict public dashboard access using network-level controls if possible
• Consider using authenticated dashboard sharing instead of public dashboards for sensitive data

# Configuration example - Disable annotations on public dashboards
# In Grafana configuration (grafana.ini or environment variables)
[public_dashboards]
# Disable annotations on all public dashboards as a temporary mitigation
annotations_enabled = false