CVE-2026-17183

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

CVE-2026-17183

An authenticated user with permission to create or edit alert rules ca ...

GHSA-f74r-h7qj-c63f

Summary An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource. The alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid. ## Impact This bypass can expose data accessible through Grafana's configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High. Integrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated. ## Attack prerequisites - Authenticated, low-privileged user in the same G...