Is CVE-2021-39226 exploited in the wild?

Yes. CVE-2021-39226 is known to be exploited in the wild, first recorded on 25 August 2022. Treat it as urgent.

How severe is CVE-2021-39226?

Critical severity, with a CVSS score of 3.1, published 5 October 2021.

Which products and versions are affected?

github.com/grafana/grafana (Go) SEMVER:introduced=0,fixed=7.5.11.

Is there a fix for CVE-2021-39226?

Yes. github.com/grafana/grafana (Go): upgrade to 7.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-39226 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-39226?

Check whether you run github.com/grafana/grafana (Go) or Grafana Labs Grafana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-39226: Authentication bypass for viewing and deletions of snapshots

CVE-2021-39226 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2021-10-05

Grafana contains an authentication bypass vulnerability where unauthenticated and authenticated users can view or delete snapshot data by accessing specific literal API paths. This occurs because the application fails to properly authorize access to snapshots with the lowest database keys, potentially leading to complete data loss.

Technologies: github.com/grafana/grafana (Go), Grafana Labs Grafana. Vendors: Go, Grafana Labs.

Quick answers

Is CVE-2021-39226 exploited in the wild?: Yes. CVE-2021-39226 is known to be exploited in the wild, first recorded on 25 August 2022. Treat it as urgent.
How severe is CVE-2021-39226?: Critical severity, with a CVSS score of 3.1, published 5 October 2021.
Which products and versions are affected?: github.com/grafana/grafana (Go) SEMVER:introduced=0,fixed=7.5.11.
Is there a fix for CVE-2021-39226?: Yes. github.com/grafana/grafana (Go): upgrade to 7.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-39226 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-39226?: Check whether you run github.com/grafana/grafana (Go) or Grafana Labs Grafana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/grafana/grafana (Go): upgrade to 7.5.11 or later
```
go get github.com/grafana/grafana@v7.5.11
```

Affected products

Grafana Labs Grafana < 7.5.11, < 8.1.6

Identifiers

CVE-2021-39226
GHSA-69j6-29vr-p3j9

Timeline

2021-10-05: disclosed: Public disclosure via oss-security mailing list
2022-08-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-08-25: advisory: NVD publication date
2021-10-05: patched: Fixes released in versions 8.1.6 and 7.5.11
exploited: Reported as exploited in the wild by CISA and other sources.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.