CVE-2026-17183: CVE Record
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
Affected Software
Event History
Frequently Asked Questions
Is unauthenticated access sufficient to exploit this issue?
No. Exploitation requires an authenticated low-privileged user in the same Grafana organization.
What permissions and information does an attacker need?
The attacker needs permission to create or edit alert rules in an accessible folder, the UID of a target datasource, and no datasources:query permission for that datasource. They abuse the client-controlled queryType value __expr__ while retaining the real datasource UID.
What data could be exposed?
The bypass can expose data available through the credentials configured for the targeted Grafana datasource, even when the user is not authorized to query that datasource directly.
Is the impact limited to data disclosure?
Confidentiality impact is high. Some datasource backends and configured credentials may also allow state-changing queries, creating a low integrity impact; no availability impact has been demonstrated.