The vulnerability allows an attacker to obtain passwords for all direct data‑sources that are associated with a public dashboard, even if those data‑sources are not used in the dashboard tiles. Exposing these credentials can enable the attacker to access the underlying databases or other systems that the data‑sources connect to, compromising data confidentiality. This weakness is a classic example of sensitive information exposure, allowing an attacker to read or exploit credentials that should remain private.

Grafana dashboards that are marked public and use direct data‑source connections. No specific product versions were disclosed in the advisory; it applies to all Grafana deployments that have not yet applied the vendor patch for CVE‑2026‑27877.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. Because the attack vector involves a publicly exposed dashboard, any individual with network access to the Grafana instance can exploit the flaw, making it relatively easy for an external actor to retrieve credentials. The EPSS score is not provided and the vulnerability is not currently listed in the CISA KEV catalog, but the potential damage from credential compromise is significant. The attack is straightforward: access any public dashboard that contains direct data‑source links, and the passwords are rendered in the rendered HTML.