CVE-2026-28380: Authentication Bypass Vulnerability

CVE-2026-28380 Overview

CVE-2026-28380 is a broken access control vulnerability in Grafana. Any user with the Editor role can delete any snapshot, including snapshots they have no permission to read or write. The flaw enables unauthorized destruction of dashboard snapshot data through the network-accessible API. Exploitation requires only low-privileged authenticated access and no user interaction. The issue is tracked under Grafana Security Advisory CVE-2026-28380.

Critical Impact
Editors can permanently delete arbitrary snapshots across the Grafana instance, causing loss of integrity and operational data without requiring elevated privileges.

Affected Products

Grafana (see vendor advisory for affected versions)
Grafana Enterprise (see vendor advisory for affected versions)
Grafana Cloud (refer to vendor advisory)

Discovery Timeline

2026-05-13 - CVE-2026-28380 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28380

Vulnerability Analysis

The vulnerability is a broken access control issue in Grafana's snapshot management API. Grafana snapshots are shareable, point-in-time exports of dashboards. The delete snapshot endpoint fails to verify whether the requesting user owns or has read/write permissions on the targeted snapshot. As a result, any authenticated user assigned the Editor role can invoke the delete operation against any snapshot identifier in the system.

The attack is performed remotely over the network with low complexity. The attacker needs valid Editor credentials but does not need to interact with another user. There is no confidentiality impact because the endpoint does not return snapshot contents. The integrity impact is high because deletion is irreversible and affects data owned by other users.

Root Cause

The root cause is a missing authorization check on the snapshot deletion handler. The handler authenticates the caller and confirms the Editor role but does not evaluate per-resource ownership or access control list entries before performing the destructive operation. This corresponds to a missing authorization weakness in the broken access control class.

Attack Vector

An authenticated Editor sends an HTTP DELETE request to the snapshot API with the target snapshot key or identifier. Because the server omits the ownership check, the request succeeds regardless of who created the snapshot or what permissions are attached to it. The vulnerability mechanism is described in the Grafana Security Advisory CVE-2026-28380. No verified proof-of-concept code is published.

Detection Methods for CVE-2026-28380

Indicators of Compromise

Unexpected DELETE requests against /api/snapshots/{key} or /api/annotations snapshot endpoints from Editor accounts.
Audit log entries showing snapshot deletions performed by users who did not create the affected snapshots.
User reports of missing dashboard snapshots that previously existed.

Detection Strategies

Enable and forward Grafana audit logs to a centralized log platform and alert on snapshot deletion events.
Correlate snapshot creator identity with the user performing the delete action to surface cross-user deletions.
Baseline normal snapshot deletion volume per Editor account and alert on deviations.

Monitoring Recommendations

Monitor Grafana API access logs for DELETE method calls against snapshot routes.
Track Editor-role account activity for anomalous administrative actions on shared resources.
Review identity provider logs for unusual Editor logins preceding snapshot deletion bursts.

How to Mitigate CVE-2026-28380

Immediate Actions Required

Upgrade Grafana to the fixed version listed in the Grafana Security Advisory CVE-2026-28380.
Audit Editor role assignments and remove the role from accounts that do not require dashboard editing.
Back up existing snapshots and dashboard configurations before applying changes.

Patch Information

Grafana has issued a security advisory with patched versions. Refer to the Grafana Security Advisory CVE-2026-28380 for the exact fixed releases and upgrade instructions.

Workarounds

Restrict the Editor role to trusted users until the patch is applied.
Disable the snapshot feature using the [snapshots] enabled = false configuration option if snapshots are not required.
Place Grafana behind an authenticating reverse proxy and block DELETE requests to snapshot endpoints for non-administrative users.

bash

# Configuration example: disable snapshots in grafana.ini
[snapshots]
enabled = false
external_enabled = false