CVE-2026-21727

A flaw was found in Grafana. This cross-tenant isolation vulnerability affects legacy correlation records, specifically those created prior to Grafana 10.2. A user with datasource management privileges can exploit a backward compatibility condition, which allows records with an organization ID (org_id) of 0 to be returned across different organizations. This enables the user to read and permanently delete sensitive correlation data belonging to other organizations.

This Low impact cross-tenant isolation vulnerability in Grafana affects legacy correlation records created prior to Grafana 10.2. A user with datasource management privileges could read and permanently delete correlation data from other organizations due to a backward compatibility condition. Red Hat products utilizing Grafana with such legacy records are affected. Red Hat Product Seurity team has rated this vulnerability as having a Low severity, this is due the fact the attacker needs to have high privileges within the targeted Grafana instance and additionally the system needs to be making using of legacy correlation records limiting the confidentiality and integrity impact for the related records.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.