Grafana Datasource Proxy API Improper Authorization Vulnerability

A vulnerability in Grafana's datasource proxy API allows users with minimal permissions to bypass authorization checks and gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. This issue arises by adding an extra slash character in the URL path, primarily affecting datasources with route-specific permissions, such as Alertmanager and certain Prometheus-based datasources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data in Alertmanager and Prometheus datasources, potentially allowing for misuse of this information or disruption of services that rely on these monitoring tools.

Remediation

Users are strongly recommended to upgrade to the latest release of Grafana Incoming Goods Suite (version 1.2.1 or higher).