Description
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Published: 2026-04-15
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The description explains that the cross‑tenant data disclosure and deletion flaw arises from Grafana’s Correlations feature, where legacy records tagged with org_id=0 are inadvertently returned to all organizations. A user with datasource‑management privileges can read and permanently delete these legacy correlation entries, potentially exposing sensitive information and erasing critical analytics data. This misconfiguration in access control produces unauthorized disclosure and modification of data across tenants.

Affected Systems

Grafana Correlations is affected. Vulnerable installations include any Grafana 10.x version or Grafana 11.x prior to 11.6.10, Grafana 12.0.x prior to 12.0.9, Grafana 12.1.x prior to 12.1.6, and Grafana 12.2.x prior to 12.2.4. Correlations created before Grafana 10.2 are also impacted.

Risk and Exploitability

Based on the description, the attack vector involves a user with datasource‑management privileges accessing the legacy correlation records. The CVSS score of 3.3 classifies the vulnerability as low severity; the EPSS score of <1% indicates a very low likelihood of real‑world exploitation, and it is not listed in the KEV catalog. To exploit the flaw, an attacker would need to possess or compromise an account that has datasource‑management privileges within Grafana and then access the legacy correlation records, read their contents and perform delete operations that permanently erase the data.

Generated by OpenCVE AI on August 22, 2026 at 13:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Grafana Correlations patch available for version 11.6.11, 12.0.9, 12.1.6, or 12.2.4 and later.
  • Restrict datasource‑management privileges to trusted users and enforce the principle of least privilege.
  • Review and delete legacy correlation records that were created before Grafana10.2 to reduce potential exposure.
  • If upgrading is not immediately possible, monitor and audit any action performed by users with datasource‑management rights for unauthorized data deletion.

Generated by OpenCVE AI on August 22, 2026 at 13:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Wed, 19 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana severity: Low cve: CVE-2026-21727 cvss_score: "3.3" cvss_vector: "CVSS:3.3/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N" fixed_versions: - ">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4" --- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability. A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

Mon, 20 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Grafana grafana
CPEs cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
Vendors & Products Grafana grafana

Mon, 20 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-732

Fri, 17 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-653
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 16 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana Correlations
Vendors & Products Grafana
Grafana grafana Correlations

Wed, 15 Apr 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Wed, 15 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Description --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana severity: Low cve: CVE-2026-21727 cvss_score: "3.3" cvss_vector: "CVSS:3.3/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N" fixed_versions: - ">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4" --- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Title Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Grafana Grafana Grafana Correlations
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-08-27T17:22:44.594Z

Reserved: 2026-01-05T09:26:06.215Z

Link: CVE-2026-21727

cve-icon Vulnrichment

Updated: 2026-04-15T19:56:56.495Z

cve-icon NVD

Status : Modified

Published: 2026-04-15T20:16:34.290

Modified: 2026-08-19T19:17:14.593

Link: CVE-2026-21727

cve-icon Redhat

Severity : Low

Publid Date: 2026-04-15T18:57:25Z

Links: CVE-2026-21727 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T14:00:17Z

Weaknesses
  • CWE-653

    Improper Isolation or Compartmentalization

  • CWE-732

    Incorrect Permission Assignment for Critical Resource