# CVE-2021-39226: Authentication bypass for viewing and deletions of snapshots

Source: https://junglewise.ai/threats/cve-2021-39226-grafana-authentication-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-10-05. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-39226 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2021-10-05

Grafana contains an authentication bypass vulnerability where unauthenticated and authenticated users can view or delete snapshot data by accessing specific literal API paths. This occurs because the application fails to properly authorize access to snapshots with the lowest database keys, potentially leading to complete data loss.

Technologies: [github.com/grafana/grafana (Go)](https://junglewise.ai/threats/technologies/github-com-grafana-grafana), [Grafana Labs Grafana](https://junglewise.ai/threats/technologies/grafana). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Grafana Labs](https://junglewise.ai/threats/vendors/grafana-labs).

## Quick answers

**Is CVE-2021-39226 exploited in the wild?** Yes. CVE-2021-39226 is known to be exploited in the wild, first recorded on 25 August 2022. Treat it as urgent.

**How severe is CVE-2021-39226?** Critical severity, with a CVSS score of 3.1, published 5 October 2021.

**Which products and versions are affected?** github.com/grafana/grafana (Go) SEMVER:introduced=0,fixed=7.5.11.

**Is there a fix for CVE-2021-39226?** Yes. github.com/grafana/grafana (Go): upgrade to 7.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-39226 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-39226?** Check whether you run github.com/grafana/grafana (Go) or Grafana Labs Grafana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/grafana/grafana (Go): upgrade to 7.5.11 or later

  ```sh
  go get github.com/grafana/grafana@v7.5.11
  ```


## Affected products

- Grafana Labs Grafana < 7.5.11, < 8.1.6

## Identifiers

- CVE-2021-39226
- GHSA-69j6-29vr-p3j9

## Timeline

- 2021-10-05: disclosed: Public disclosure via oss-security mailing list
- 2022-08-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-08-25: advisory: NVD publication date
- 2021-10-05: patched: Fixes released in versions 8.1.6 and 7.5.11
- exploited: Reported as exploited in the wild by CISA and other sources.

## Related threats

- [Grafana authorization bypass in Git Sync](https://junglewise.ai/threats/cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git)
- [Grafana authorization bypass in Git Sync managed resources](https://junglewise.ai/threats/cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder)
- [Grafana server-side request forgery via Git Sync configuration](https://junglewise.ai/threats/cve-2026-110289-a-user-with-the-organization-admin-role-could-point-the-server)
- [Grafana authentication bypass in image renderer](https://junglewise.ai/threats/cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering)
- [Grafana Azure Monitor SSRF with token disclosure](https://junglewise.ai/threats/cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in)