CVE-2021-39226

An authentication bypass was found in grafana. An attacker on the network is able to view and delete snapshots by accessing a literal path.

In OpenShift Container Platform (OCP), Red Hat Advanced Cluster Management for Kubernetes (RHACM), and OpenShift ServiceMesh (OSSM) the grafana components are protected by OpenShift OAuth that reduces the impact of this flaw to Moderate. Access to the grafana panel where snapshots can be created requires admin permissions. Additionally snapshots by default are not available to unauthenticated users and don't contain sensitive data.

Since snapshots by default are not available to unauthenticated users and don't contain sensitive data, impact has been lowered for Red Hat Gluster Storage 3.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.