CVE-2022-26148: Grafana

Critical severity, CVSS 9.8. EPSS: 53.4% chance of exploitation in the next 30 days.

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Affected products

• Grafana Grafana: up to and including 7.3.4
• Red Hat Ceph Storage: version 3.0 only; version 4.0 only; version 5.0 only
• Red Hat Storage: version 3.0 only

Published 2022-03-21. Last modified 2026-06-17.