CVE-2026-13719

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.

This Moderate impact flaw allows an authenticated Grafana user to retrieve alert-rule configurations from folders they cannot read by querying the alert-rule list API. Disclosure is limited to the organization’s rule configurations; data source credentials are not exposed. Red Hat products shipping Grafana builds with the vulnerable behavior are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.