CVE-2026-21727: Github.com/grafana/grafana Grafana Legacy Correlations Allow Cross-tenant Vulnerability
LOWCVE-2026-21727 is a LOW (CVSS 3.3) grafana legacy correlations allow cross-tenant vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) affecting Github.com/grafana/grafana libraries in the Go ecosystem. The issue involves grafana legacy correlations allow cross-tenant disclosure and deletion. Remediation is available by upgrading affected packages to version 1.9.2-0.20260127141016-e702db6096e0.
CVE-2026-21727 at a Glance
Security Impact
CVSS: 3.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
How to Fix CVE-2026-21727
To remediate this vulnerability, upgrade all affected Github.com/grafana/grafana dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/grafana/grafana to 1.9.2-0.20260127141016-e702db6096e0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/grafana/grafanaHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-21727, inspect your project dependencies for Github.com/grafana/grafana:
inspect dependencies for github.com/grafana/grafanaAnalyze the terminal output to locate any version of Github.com/grafana/grafana in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.2-0.20260127141016-e702db6096e0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-732: Incorrect Permission Assignment for Critical Resource, where the product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. In Github.com/grafana/grafana, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-21727 Affected Github.com/grafana/grafana Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/grafana/grafana
|
Go |
< 1.9.2-0.20260127141016-e702db6096e0
|
1.9.2-0.20260127141016-e702db6096e0
|
References
Frequently Asked Questions
What is CVE-2026-21727?
Which Github.com/grafana/grafana versions are affected?
What version fixes CVE-2026-21727?
Is github.com/grafana/grafana affected?
What is the CVSS score of CVE-2026-21727?
What CWE is associated with CVE-2026-21727?
How can I check Go dependencies for CVE-2026-21727?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p5x9-j974-rpfp",
"modified" : "2026-10-05T22:33:25Z",
"published" : "2026-04-15T21:30:18Z",
"aliases" : [ "CVE-2026-21727" ],
"summary" : "Grafana legacy correlations allow cross-tenant disclosure and deletion",
"details" : "---\nhero:\n image: /static/img/heros/hero-legal2.svg\n content: \"# Cross-Tenant Legacy Correlation Disclosure and Deletion\"\ndate: 2026-01-29\nproduct: Grafana\nfixed_versions:\n - \">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4\"\n---\nA cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/grafana/grafana"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.9.2-0.20260127141016-e702db6096e0"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-21727"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/2b2847625b8a77ba47128ccb5ecbcd72542cb9bc"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/2cf0dd6fde3f5a2b92864e2376ae5378c7df45e2"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/4010ee30bb441bc399a1f37bdc8ab55ec909f3b7"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/8e7ea333991d913298bd68d4787da9c6977a0a8c"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/a9a98fc4327182d1bdb9a74b5c2938d5c127e764"
}, {
"type" : "WEB",
"url" : "https://github.com/grafana/grafana/commit/e702db6096e0509ff2825f732697f077e9e6289f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/grafana/grafana"
}, {
"type" : "WEB",
"url" : "https://grafana.com/security/security-advisories/cve-2026-21727"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-732" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-05T22:33:25Z",
"nvd_published_at" : "2026-04-15T20:16:34Z"
}
}