CVE-2026-15815: CVE Record

Published Sep 17, 2026

Updated

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GFINSTALLPLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Affected Software

2 affected components

Grafana Grafana OSS

Grafana Grafana Enterprise

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grafana (Grafana OSS/Grafana Enterprise) to a version that resolves this vulnerability.
Patch CVE-2026-15815
Compensating control
Restrict Grafana server process privileges (least privilege) to limit impact of remote code execution via crafted plugin archive writing executable files outside the plugin installation directory.
Operational
Ensure plugin archives are safely handled so symbolic links are resolved correctly (Grafana OSS/Grafana Enterprise plugin extraction code did not safely resolve symbolic links).

Event History

Sep 17, 2026

CVE Published

via MITRE·08:47 PM

Data Sourced

via MITRE·08:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed to this issue?

Both Grafana OSS and Grafana Enterprise are affected because they use the same plugin extraction code. Exposure arises when a plugin archive is installed, including through grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

What does an attacker need to exploit this vulnerability?

An attacker needs an operator to install a crafted plugin archive. Exploitation does not require the archive to be unsigned: plugin archives are extracted before signature verification, so an archive that appears legitimate can still trigger the unsafe extraction.

What is the impact if exploitation succeeds?

The crafted archive can use chained relative symbolic links to write arbitrary files and an executable backend binary outside the plugin installation directory. That binary runs with the privileges of the Grafana server process, enabling remote code execution.