// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# 27 Oct
-
SSO settings authorization bypass
Grafana OSS and Enterprise 13.2 with kubernetesSsoSettingsApi enabled allow authenticated users to read SSO client secrets and modify settings without proper authorization.
-
Server-side expression parser denial of service
Grafana allows a Viewer role user to crash the server via a crafted server-side math expression causing uncontrolled recursion, with alert rule permissions enabling persistent outages.
-
Azure Monitor access token disclosure via SSRF
Grafana allows a user with query access to an Azure Monitor data source to perform SSRF, disclosing the data source's Azure access token via an attacker-controlled endpoint.
-
Alerting contact point authorization bypass via schema downgrade
Grafana allows an authorization bypass via schema downgrade, enabling users who can edit contact points to change protected settings like destination URLs, potentially exposing credentials.