VDB
Sign up
MEDIUM6.5

GHSA-3q27-7qjq-p9c5

Grafana public dashboards disclose all direct mode datasources

Quick fix

GHSA-3q27-7qjq-p9c5 — github.com/grafana/grafana: upgrade to the fixed version with the command below.

go get github.com/grafana/grafana@v1.9.2-0.20260325055210-3522153e07b4

Details

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/grafana/grafana
Introduced in: 9.3.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.0.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.2.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.3.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 12.4.0

No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/grafana/grafana
Introduced in: 1.9.2-0.20221116104934-4ee83a5f2bf4Fixed in: 1.9.2-0.20260325055210-3522153e07b4
Fixgo get github.com/grafana/grafana@v1.9.2-0.20260325055210-3522153e07b4

References