Grafana -- Authorization bypass in data source proxy API

2025-04-24 · CVE-2025-3454 · VuXML entry

Grafana Labs reports: This vulnerability, which was discovered while reviewing a pull request from an external contributor, effects Grafana’s data source proxy API and allows authorization checks to be bypassed by adding an extra slash character (/) in the URL path. Among Grafana-maintained data sources, the vulnerability only affects the read paths of Prometheus (all flavors) and Alertmanager when configured with …

Affected versions

• grafana >= 8.0.0 < 10.4.17+security-01; >= 11.0.0 < 11.2.8+security-01; >= 11.3.0 < 11.3.5+security-01; >= 11.4.0 < 11.4.3+security-01; >= 11.5.0 < 11.5.3+security-01; >= 11.6.0 < 11.6.0+security-01
• grafana8 >= 8.0.0
• grafana9 >= 9.0.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.