CVE-2022-35957
grafana: Escalation from admin to server admin when auth proxy is used
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 20, 2022
Updated · August 5, 2026
Description
A flaw was found in the grafana package. Auth proxy allows authentication of a user by only providing the username (or email) in an X-WEBAUTH-USER HTTP header. The trust assumption is that a front proxy will take care of authentication and that the Grafana server is only publicly reachable with this front proxy.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-288 · Authentication Bypass Using an Alternate Path or Channel