When a Grafana dashboard is enabled for public viewing and uses direct data sources, the dashboard reveals the passwords of those data sources even if they are not referenced within the dashboard. This exposes credential information to any viewer and allows an attacker to obtain passwords for databases or services that would otherwise remain hidden. The flaw is an information‑exposure vulnerability.

All Grafana deployments that permit public dashboards and configure direct data sources are vulnerable. Because the advisory does not identify specific version ranges, every currently supported release that allows this configuration should be assumed to be affected unless a patch is applied.

The severity score of 6.5 marks the issue as moderate. The estimated likelihood of exploitation is below one percent, indicating that it is not widely targeted at present. This vulnerability is not listed in the known exploited vulnerabilities catalog of the national cyber security agency. An attacker only needs to view a public dashboard, which is readily accessible to anyone with that view, making the attack vector straightforward and not dependent on privileged access.