CVE-2025-3454

A vulnerability was found in Grafana's data source proxy API, which allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alert manager and Prometheus data sources. The issue primarily affects data sources that implement route-specific permissions, including Alert manager and certain Prometheus-based data sources.

This vulnerability is classified as a Moderate severity as it allows users with minimal permissions, including Viewer role, to bypass route-specific authorization checks in Grafana’s data source proxy API. By appending an extra slash to the URL path, a user may gain unauthorized read-only access to endpoints in data sources such as Alertmanager and certain Prometheus-based integrations. Although the issue does not permit data modification or deletion, it undermines expected access controls and may lead to unintended exposure of monitoring data.

This issue affects Grafana versions 10.4.0 and later, which are not part of any Red Hat supported distributions. As such, Red Hat customers are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.