Mmastodon TechnologyCybersecurity first seen 17 h ago, last 17 h ago, peak #9

Grafana vulnerability let viewers alter Loki alerting rules

Original: CVE-2026-9703: Grafana's data source proxy did not apply role-based access control to Loki write requests, so a Viewer-o

A new vulnerability, CVE-2026-9703, has been disclosed in Grafana's data source proxy, which failed to apply role-based access control to Loki write requests. As a result, an account with only Viewer privileges could create, modify or delete Loki alerting rules, affecting every user of that data source. All releases through 13.0.3 are affected, and administrators are urged to update to a patched version.

Why now: Security teams are sharing the advisory so Grafana administrators patch before the flaw is exploited.

GrafanaLokiCVE-2026-9703

Open on mastodon →

Evidence

• CVE-2026-9703: Grafana's data source proxy did not apply role-based access control to Loki write requests, so a Viewer-only account could create, modify or delete Loki alerting rules affecting every user of that data source. Releases through 13.0.3 are affected. Update to… · suriq@infosec.exchange · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/2369769