Is CVE-2026-9703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9703 being exploited in the wild.

How severe is CVE-2026-9703?

High severity, with a CVSS score of 7.1, published 15 October 2026.

Which products and versions are affected?

Grafana Enterprise before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3; Grafana OSS before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3.

Is there a fix for CVE-2026-9703?

Yes: fixed in Grafana OSS and Enterprise: 8.0.0 or later, 12.3.9, 12.4.6 or later, 13.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9703 attacked?

It is attacked over the network.

Am I affected by CVE-2026-9703?

Check whether you run Grafana Enterprise or Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9703: Grafana data source proxy authorization bypass in Loki rules API

CVE-2026-9703 · Severity: high · CVSS 7.1 · Published 2026-10-15

Grafana's data source proxy, which forwards requests to monitoring systems like Loki, failed to enforce role-based access control on write operations. A user with only read-only Viewer permissions could send requests to create, modify, and delete Loki alerting rules affecting all users of that data source. An attacker with a basic Viewer account could disrupt monitoring and alerting for an entire organization.

Technologies: Grafana Enterprise, Grafana OSS. Vendors: Grafana.

Quick answers

Is CVE-2026-9703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9703 being exploited in the wild.
How severe is CVE-2026-9703?: High severity, with a CVSS score of 7.1, published 15 October 2026.
Which products and versions are affected?: Grafana Enterprise before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3; Grafana OSS before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3.
Is there a fix for CVE-2026-9703?: Yes: fixed in Grafana OSS and Enterprise: 8.0.0 or later, 12.3.9, 12.4.6 or later, 13.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9703 attacked?: It is attacked over the network.
Am I affected by CVE-2026-9703?: Check whether you run Grafana Enterprise or Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Grafana OSS and Enterprise: 8.0.0 or later, 12.3.9, 12.4.6 or later, 13.0.4 or later

Technical details

The data source proxy in Grafana does not validate role-based access control when forwarding POST, PUT, and DELETE requests to the Loki rules API endpoint (/loki/api/v1/rules). A Viewer-authenticated user can bypass this check to perform write operations on Loki rules that are persisted in Loki itself rather than in Grafana. The vulnerability requires an authenticated Viewer account and a configured Loki data source; affects Grafana OSS and Enterprise.

Affected products

Grafana Grafana OSS before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3
Grafana Grafana Enterprise before 8.0.0, 12.3.9, 12.4.0 through 12.4.5, 13.0.0 through 13.0.3

Timeline

2026-06-27: advisory
2026-10-15: disclosed

References

https://grafana.com/security/security-advisories/cve-2026-9703

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.