Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-9703— Viewer role can create, modify and delete Loki alerting rules

Quick assessment

Affected
Grafana Grafana Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grafana 的数据源代理未对转发至 Loki 数据源的写入请求实施基于角色的访问控制（RBAC）。在受影响版本的 Grafana 实例中，仅拥有“Viewer（只读）”角色的用户也可通过代理向 Loki 规则 API（/loki/api/v1/rules）发送 POST、PUT 和 DELETE 请求，从而创建、修改和删除 Loki 告警规则。由于这些规则由 Loki 存储而非 Grafana 存储，因此该变更会对使用该 Loki 数据源的所有用户生效，而不仅仅是发起请求的 Viewer 用户。 利用此漏洞需要

CVSS 7.1 · High

Affected Version Matrix 11

VendorProduct Version RangeStatus
Grafana Grafana Enterprise 8.0.0≤ 11.5.10 affected
11.6.0≤ 11.6.16 affected
12.0.0≤ 12.1.10 affected
12.2.0≤ 12.2.10 affected
12.3.0≤ 12.3.8 affected
12.4.0≤ 12.4.5 affected
13.0.0≤ 13.0.3 affected
Grafana Grafana OSS 12.3.0≤ 12.3.8 affected
12.4.0≤ 12.4.5 affected
8.0.0≤ 12.3.0 affected
13.0.0≤ 13.0.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9703

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Viewer role can create, modify and delete Loki alerting rules
Source: CVE Program / CVE List V5
Vulnerability Description
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Grafana Grafana Enterprise 8.0.0 ~ 11.5.10 -
Grafana Grafana OSS 12.3.0 ~ 12.3.8 -

II. Public POCs for CVE-2026-9703

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9703

请登录查看更多情报信息。

Other References for CVE-2026-9703 (1)

IV. Related Vulnerabilities

Same product: Grafana Enterprise
Same vendor: Grafana
Same weakness: CWE-284

V. Comments for CVE-2026-9703

No comments yet

Leave a comment