CVE-2026-21727: Grafana Information Disclosure Vulnerability

CVE-2026-21727 Overview

A cross-tenant isolation vulnerability was discovered in Grafana's Correlations feature that affects legacy correlation records. Due to a backward compatibility condition that allows records with org_id = 0 to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue specifically affects correlations created prior to Grafana 10.2.

Critical Impact

Users with datasource management privileges can access and delete legacy correlation data from other organizations, potentially exposing sensitive operational data and disrupting cross-organizational data relationships.

Affected Products

• Grafana versions prior to 11.6.11
• Grafana versions prior to 12.0.9
• Grafana versions prior to 12.1.6
• Grafana versions prior to 12.2.4

Discovery Timeline

• 2026-01-29 - Vulnerability discovered by Gyu-hyeok Lee (g2h)
• 2026-04-15 - CVE CVE-2026-21727 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-21727

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw within Grafana's multi-tenant architecture. The Correlations feature, which allows users to link data sources together for enhanced data analysis, contains a legacy code path that improperly handles organization isolation.

The core issue stems from how Grafana manages backward compatibility with correlation records created before version 10.2. Legacy records were stored with an org_id value of 0, which was intended as a placeholder. However, the query logic for retrieving correlations fails to properly filter these legacy records by the requesting user's organization context.

When a user with datasource management privileges queries for correlations, the system returns not only correlations belonging to their organization but also any legacy correlations with org_id = 0. This breaks the fundamental tenant isolation boundary that multi-tenant SaaS deployments depend upon.

Root Cause

The root cause is an improper access control implementation in the Correlations API that fails to enforce organization-level isolation for legacy records. The backward compatibility logic treats org_id = 0 as a wildcard rather than properly scoping these records to their original tenant context. This design flaw allows cross-tenant data access when the database query conditions do not exclude records with org_id = 0 from responses to organization-specific requests.

Attack Vector

An attacker with legitimate access to a Grafana instance and datasource management privileges can exploit this vulnerability through the Correlations API. The attack requires network access and elevated privileges within the Grafana environment, making it a high-complexity attack scenario.

The exploitation path involves:

1. Authenticating to a multi-tenant Grafana deployment with datasource management privileges
2. Querying the Correlations API endpoint to retrieve correlation data
3. Observing correlation records with org_id = 0 that belong to other organizations
4. Optionally, issuing delete requests to permanently remove cross-tenant legacy correlation data

The attacker can leverage this access to perform reconnaissance on other organizations' data correlation patterns or maliciously delete critical correlation configurations, disrupting operations for affected tenants.

Detection Methods for CVE-2026-21727

Indicators of Compromise

• Unusual API activity targeting the Correlations endpoint from users with datasource management privileges
• Audit log entries showing correlation queries or deletions for records with org_id = 0
• Unexplained deletion of legacy correlation records across multiple organizations
• Access patterns showing users querying correlation data outside their normal organizational scope

Detection Strategies

• Monitor Grafana audit logs for correlation API access patterns, particularly focusing on queries that return records with org_id = 0
• Implement alerting for bulk correlation deletions or unusual access frequencies from datasource admin accounts
• Review access control logs for any cross-organizational correlation data access attempts
• Enable detailed API request logging to track which users are accessing correlation endpoints

Monitoring Recommendations

• Configure centralized logging for all Grafana API requests to the /api/correlations endpoints
• Establish baselines for normal correlation access patterns per user and alert on deviations
• Implement real-time monitoring for correlation deletion events in multi-tenant environments
• Periodically audit the presence of legacy org_id = 0 correlation records in the database

How to Mitigate CVE-2026-21727

Immediate Actions Required

• Upgrade Grafana to a patched version: >=11.6.11, >=12.0.9, >=12.1.6, or >=12.2.4
• Review and audit existing correlation records to identify any legacy records with org_id = 0
• Temporarily restrict datasource management privileges to trusted administrators only
• Enable enhanced audit logging for correlation-related API activity

Patch Information

Grafana has released security patches addressing this cross-tenant isolation vulnerability. Organizations should upgrade to one of the following fixed versions based on their current deployment:

• Version 11.6.11 or later for the 11.6.x branch
• Version 12.0.9 or later for the 12.0.x branch
• Version 12.1.6 or later for the 12.1.x branch
• Version 12.2.4 or later for the 12.2.x branch

For detailed patch information and upgrade guidance, refer to the Grafana Security Advisory.

Workarounds

• Review and migrate legacy correlation records by assigning proper org_id values to records currently set to 0
• Implement network-level access controls to limit who can reach the Grafana Correlations API
• Apply principle of least privilege by reducing the number of users with datasource management permissions
• Consider implementing application-layer firewall rules to monitor and restrict correlation API access patterns

# Configuration example
# Verify current Grafana version
grafana-cli --version

# Check for legacy correlation records with org_id = 0 (requires database access)
# PostgreSQL example:
# SELECT * FROM correlation WHERE org_id = 0;

# Upgrade Grafana to patched version using package manager
# For Debian/Ubuntu:
sudo apt-get update
sudo apt-get install grafana=12.2.4

# Restart Grafana service after upgrade
sudo systemctl restart grafana-server