CVE-2025-8341: SSRF in Infinity Datasource Plugin
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.
If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/grafana/grafana-infinity-datasourceto a version that resolves this vulnerability.Fixed in 1.4.2-0.20250731100004-9c736aa21b3a - Upgrade
Upgrade
Grafana Infinity Datasource Pluginto a version that resolves this vulnerability.Fixed in 3.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8341?
CVE-2025-8341 is classified with a medium severity level due to potential unauthorized access to sensitive data.
How do I fix CVE-2025-8341?
To fix CVE-2025-8341, update the Grafana Infinity DataSource Plugin to version 3.4.1 or later.
What systems are affected by CVE-2025-8341?
CVE-2025-8341 affects the Grafana Labs Infinity DataSource Plugin versions prior to 3.4.1.
What type of vulnerability is CVE-2025-8341?
CVE-2025-8341 is a security vulnerability that could allow attackers to bypass URL restrictions.
Who is responsible for addressing CVE-2025-8341?
Grafana Labs is responsible for addressing CVE-2025-8341 through updates and patches to the affected plugin.