High severityNVD Advisory· Published Sep 20, 2022· Updated Jan 28, 2026
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
CVE-2022-35957
Description
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/grafana/grafanaGo | >= 9.1.0, < 9.1.6 | 9.1.6 |
github.com/grafana/grafanaGo | >= 9.0.0, < 9.0.9 | 9.0.9 |
github.com/grafana/grafanaGo | < 8.5.13 | 8.5.13 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- github.com/advisories/GHSA-ff5c-938w-8c9qghsaADVISORY
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/mitrevendor-advisory
- nvd.nist.gov/vuln/detail/CVE-2022-35957ghsaADVISORY
- github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9qghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2HghsaWEB
- security.netapp.com/advisory/ntap-20221215-0001ghsaWEB
- security.netapp.com/advisory/ntap-20221215-0001/mitre
News mentions
0No linked articles in our index yet.