Grafana - Authentication Bypass (CVE-2021-39226)

Grafana server is vulnerable to CVE-2021-39226, an Authentication Bypass vulnerability in the /api/snapshots/:key endpoint. This allows attackers to view the snapshot with the lowest database key by accessing the literal path /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true, unauthenticated users are able to delete the snapshot with the lowest database key by accessing the path: /api/snapshots-delete/:deleteKey.

The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information or delete the snapshot with the lowest database key.

Upgrade the Grafana server to the latest version.

https://nvd.nist.gov/vuln/detail/CVE-2021-39226

https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9o