---
id: CVE-2025-3415
aliases:
  - GHSA-46m5-8hpj-p5p5
  - BIT-grafana-2025-3415
  - GO-2025-3814
title: Grafana's insecure DingDing Alert integration exposes sensitive information
summary: Grafana's insecure DingDing Alert integration exposes sensitive information
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: grafana
product: github.com/grafana/grafana
ecosystem: go
affected:
  - github.com/grafana/grafana < 1.9.2-0.20250514160932-04111e9f2afd
patched:
  - github.com/grafana/grafana 1.9.2-0.20250514160932-04111e9f2afd
published: '2025-07-17'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:25.691669761Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-46m5-8hpj-p5p5'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-3415'
  - url: >-
      https://github.com/grafana/grafana/commit/04111e9f2afd95ea3e5b01865cc29d3fc1198e71
  - url: >-
      https://github.com/grafana/grafana/commit/0adb869188fa2b9ae26efd424b94e17189538f29
  - url: >-
      https://github.com/grafana/grafana/commit/19c912476d4f7a81e8a3562668bc38f31b909e18
  - url: >-
      https://github.com/grafana/grafana/commit/4144c636d1a6d0b17fafcf7a2c40fa403542202a
  - url: >-
      https://github.com/grafana/grafana/commit/4fc33647a8297d3a0aae04a5fcbac883ceb6a655
  - url: >-
      https://github.com/grafana/grafana/commit/910eb1dd9e618014c6b1d2a99a431b99d4268c05
  - url: >-
      https://github.com/grafana/grafana/commit/91327938626c9426e481e6294850af7b61415c98
  - url: >-
      https://github.com/grafana/grafana/commit/a78de30720b4f33c88d0c1a973e693ebf3831717
  - url: 'https://github.com/grafana/grafana'
  - url: 'https://grafana.com/security/security-advisories/cve-2025-3415'
tags:
  - osv
  - go
  - exploit-available
epss: 0.00983
epssPercentile: 0.60846
exploits:
  nuclei:
    - CVE-2025-3415
  checkedAt: '2026-09-24T07:52:53.274Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.751Z'
---

## Overview

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. 
Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01.

## Affected packages

- `github.com/grafana/grafana < 1.9.2-0.20250514160932-04111e9f2afd`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/grafana 1.9.2-0.20250514160932-04111e9f2afd`