CVE-2026-81841: Paused shared dashboard access tokens still expose data source configuration
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Delete the shared dashboard to revoke its access token.
Event History
Frequently Asked Questions
Who can access the exposed data source configuration?
Any person who holds the link to a paused shared public dashboard can retrieve the affected frontend bootstrap data without authenticating. The issue is limited to holders of that shared-dashboard link.
What information may be exposed?
The exposed bootstrap data includes the dashboard's data source configuration. For data sources that use browser access, this can include stored credentials.
Does pausing the shared dashboard revoke access?
No. Pausing does not revoke the access token used by the affected frontend bootstrap endpoints, so the link can continue to expose data source configuration.
What can be done if pausing a shared dashboard is not sufficient?
Delete the shared dashboard. Deletion revokes its access token.