CVE-2025-3454

Description

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Reserved 2025-04-08 | Published 2025-06-02 | Updated 2025-06-02 | Assigner GRAFANA

Problem types

CWE-285

Product status

11.6.0 before 11.6.0+security-01
affected

11.5.0 before 11.5.3+security-01
affected

11.4.0 before 11.4.3+security-01
affected

11.3.0 before 11.3.5+security-01
affected

11.2.0 before 11.2.8+security-01
affected

10.4.0 before 10.4.17+security-01
affected

11.6.0 before 11.6.0+security-01
affected

11.5.0 before 11.5.3+security-01
affected

11.4.0 before 11.4.3+security-01
affected

11.3.0 before 11.3.5+security-01
affected

11.2.0 before 11.2.8+security-01
affected

10.4.0 before 10.4.17+security-01
affected

References

grafana.com/security/security-advisories/cve-2025-3454/

cve.org (CVE-2025-3454)

nvd.nist.gov (CVE-2025-3454)

Download JSON