CVE-2026-21727 Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record
Attackers with datasource privileges can read and delete cross-tenant correlation data due to improper handling of legacy org_id=0 records.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21727?
CVE-2026-21727 is a low-severity missing authorization vulnerability in Grafana Grafana, published on 15 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
Weakness: CWE-732
Which versions are affected by CVE-2026-21727?
4 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260127141016-e702db6096e0 |
github.com/grafana/grafana Go | All versions | 1.9.2-0.20260127141016-e702db6096e0 |
grafana Bitnami | All versions | 11.6.11, 12.0.9, 12.1.6, 12.2.4, 12.3.3 |
Products include Grafana Grafana.
How do I fix CVE-2026-21727?
Upgrade github.com/grafana/grafana to 1.9.2-0.20260127141016-e702db6096e0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-21727 being exploited?
There is no known exploitation of CVE-2026-21727 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-21727, CLSA-2026-1789289678, GHSA-p5x9-j974-rpfp, GO-2026-6664, MINI-3v3g-prc6-8w65, MINI-4wrj-fv72-gf9v and 13 more.