CVE-2026-81841

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve sensitive data source configurations, potentially exposing stored credentials.

This vulnerability is rated as Moderate because exploitation is restricted to unauthorized information disclosure and requires prior knowledge of the specific URL for a publicly shared dashboard. In standard Red Hat product configurations, public dashboard sharing is not enabled by default, significantly limiting overall exposure. Even if an unauthenticated user obtains the link to a paused dashboard, the impact is confined to viewing frontend bootstrap configurations and exposed data source details rather than enabling write privileges or host compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw without disabling features, permanently delete public shared dashboards rather than pausing them, which immediately revokes the associated access token.

Alternatively, disable the public dashboard capability entirely by setting the following in /etc/grafana/grafana.ini:

[public_dashboards]
enabled = false

Or configure the corresponding environment variable: GF_PUBLIC_DASHBOARDS_ENABLED=false

Apply the configuration by restarting the service:

systemctl restart grafana-server

Warning: Restarting the grafana-server service will cause a brief interruption in service availability. Disabling public dashboards will prevent all unauthenticated access and sharing of dashboards across the environment.