---
id: CVE-2026-27877
aliases:
  - GHSA-3q27-7qjq-p9c5
  - BIT-grafana-2026-27877
  - GO-2026-5095
title: Grafana public dashboards disclose all direct mode datasources
summary: Grafana public dashboards disclose all direct mode datasources
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: grafana
product: github.com/grafana/grafana
ecosystem: go
affected:
  - github.com/grafana/grafana >= 9.3.0
  - github.com/grafana/grafana >= 12.0.0
  - github.com/grafana/grafana >= 12.2.0
  - github.com/grafana/grafana >= 12.3.0
  - github.com/grafana/grafana >= 12.4.0
  - >-
    github.com/grafana/grafana >= 1.9.2-0.20221116104934-4ee83a5f2bf4, <
    1.9.2-0.20260325055210-3522153e07b4
patched:
  - github.com/grafana/grafana 1.9.2-0.20260325055210-3522153e07b4
published: '2026-03-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:36.789177708Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3q27-7qjq-p9c5'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27877'
  - url: 'https://github.com/grafana/grafana'
  - url: 'https://grafana.com/security/security-advisories/cve-2026-27877'
tags:
  - osv
  - go
epss: 0.00398
epssPercentile: 0.31307
ingestedAt: '2026-09-12T03:13:01.749Z'
---

## Overview

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

## Affected packages

- `github.com/grafana/grafana >= 9.3.0`
- `github.com/grafana/grafana >= 12.0.0`
- `github.com/grafana/grafana >= 12.2.0`
- `github.com/grafana/grafana >= 12.3.0`
- `github.com/grafana/grafana >= 12.4.0`
- `github.com/grafana/grafana >= 1.9.2-0.20221116104934-4ee83a5f2bf4, < 1.9.2-0.20260325055210-3522153e07b4`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/grafana 1.9.2-0.20260325055210-3522153e07b4`