GHSA-3q27-7qjq-p9c5
Grafana public dashboards disclose all direct mode datasources
Quick fix
GHSA-3q27-7qjq-p9c5 — github.com/grafana/grafana: upgrade to the fixed version with the command below.
go get github.com/grafana/grafana@v1.9.2-0.20260325055210-3522153e07b4Details
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
Are you affected?
Enter the version of the package you're using.
Affected packages
9.3.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
12.0.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
12.2.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
12.3.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
12.4.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
1.9.2-0.20221116104934-4ee83a5f2bf4Fixed in: 1.9.2-0.20260325055210-3522153e07b4go get github.com/grafana/grafana@v1.9.2-0.20260325055210-3522153e07b4