CVE-2024-1442 is a medium severity (CVSS 6.0) privilege escalation in Grafana. A user allowed to create data sources can use the API to set the UID to an asterisk, which grants access to read, query, edit and delete every data source in the organization. Fixed in 9.5.7, 10.0.12, 10.1.8, 10.2.5 and 10.3.4.
What's affected
Grafana's advisory lists these impacted ranges and fixed versions:
- 8.5.0 up to but not including 9.5.7, fixed in 9.5.7
- 10.0.0 up to but not including 10.0.12, fixed in 10.0.12
- 10.1.0 up to but not including 10.1.8, fixed in 10.1.8
- 10.2.0 up to but not including 10.2.5, fixed in 10.2.5
- 10.3.0 up to but not including 10.3.4, fixed in 10.3.4
Grafana rates it Medium with a score of 6.0 and the same vector the record carries, so the record and the advisory agree on severity. The attacker needs permission to create data sources, which the vector reflects as high privileges.
How to check if you're exposed
Check the Grafana version through the UI help menu, or from the command line on the server:
grafana server -v
For containers, read the image tag you deploy. Then list who holds the data source creation permission in each organization. Anyone with it can reach every data source in that organization on an unpatched version, including ones holding credentials for databases.
Review your data sources for any entry whose UID is a single asterisk.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Identify every Grafana instance and its version.
- Upgrade to 9.5.7, 10.0.12, 10.1.8, 10.2.5, 10.3.4 or later, matching your release line.
- Review which users and service accounts can create data sources and remove the permission where it is not needed.
- Look for data sources with an unusual UID and delete any you did not create.
- Rotate credentials stored in data sources if you cannot rule out misuse.
Why it matters
The record classes this as CWE-269, improper privilege management. The UID field was treated as a literal value that also works as a wildcard in permission matching, so one new data source could widen what its creator could touch.
Data sources often store connection details for production databases and metrics stores. Gaining read, edit and delete on all of them turns a narrow creation right into broad control. It is scored Medium because it needs an existing privileged account. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Grafana versions are fixed?
9.5.7, 10.0.12, 10.1.8, 10.2.5 and 10.3.4, one for each affected line.
Does this need an administrator?
It needs the permission to create data sources, not full administrator rights.
Sources
- Grafana security advisory for CVE-2024-1442
- NetApp advisory listed in the record (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1442
Last reviewed: 19 October 2026.
