VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 18, 2021· Updated Aug 3, 2024

CVE-2021-27358

CVE-2021-27358

Description

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana snapshot feature allows unauthenticated remote denial of service when anonymous access is enabled, affecting versions 6.7.3 to 7.4.1.

The vulnerability exists in Grafana's snapshot feature, which allows creating and sharing dashboard snapshots. When anonymous access is enabled (a common configuration), the snapshot creation endpoint does not properly authenticate requests, allowing unauthenticated remote attackers to create snapshots [1][4]. This can be exploited by sending a large number of snapshot creation requests to the API.

An attacker can exploit this without any prior authentication or network access beyond being able to reach the Grafana instance. The only prerequisite is that anonymous access is enabled, which is often configured for public dashboards [1]. The attacker simply sends crafted HTTP requests to the snapshot API endpoint.

Successful exploitation can lead to a denial of service (DoS) by exhausting server resources such as disk space or memory due to the creation of excessive snapshots [1]. Depending on the server's capacity, this could cause the Grafana service to become unresponsive.

The issue was patched in Grafana version 7.4.2, released on 2021-02-17 [2][3]. Users are advised to upgrade to this version or later, or to disable anonymous snapshot creation if upgrading is not immediately possible [4].

References
  1. NVD - CVE-2021-27358
  2. grafana/CHANGELOG.md at main · grafana/grafana
  3. grafana/CHANGELOG.md at main · grafana/grafana
  4. Security: Do not allow an anonymous user to create snapshots. CVE-2021-27358 by marefr · Pull Request #31263 · grafana/grafana

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
>= 6.7.3, < 7.4.27.4.2

Affected products

166

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.