CVE-2026-21724

Medium

Advisory

Published 26 Mar 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.003; 18th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 15; deployed by those charts
Fix available: 1 of 1; affected package

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 15 images.

Affected package	Affected versions	Fixed in	Images
github.com/grafana/grafanagolang	v0.0.0-20230830192226-0cfa76b22dd5, v0.0.0-20231011162216-849c612fcb73, v0.0.0-20231218140301-1e84fede543a, v0.0.0-20250812085420-df5de8219b41+dirty+9 more	1.9.2-0.20260323180334-daffe750de85	15

OSV records: GHSA-7g92-g4vh-hp84 GO-2026-5219
Also known as: BIT-grafana-2026-21724

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

kubecostmesosphere-stable

0.37.5

1 of 9 See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.7	1a359d92f40e	github.com/grafana/grafana@v9.4.7	no fix listed

Open the chart page →

17,693

sn-platformstreamnative

1.11.44

1 of 9 See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/grafana/grafana@v9.5.6	no fix listed

Open the chart page →

15,477

clearml-servingallegroai

1.6.2

1 of 9 See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :9.4.3	76dcf36e7d2a	github.com/grafana/grafana@v9.4.3	no fix listed

Open the chart page →

17,877

dbrepodbrepo

1.13.3

1 of 25 See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/grafana/grafana@v11.3.1	no fix listed

Open the chart page →

52,635

carettagroundcover

0.0.16

1 of 3 See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	no fix listed

Open the chart page →

6,799

drogue-cloud-examplesdrogue-iot

0.7.11

1 of 6 See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	no fix listed

Open the chart page →

30,699

drogue-cloud-metricsdrogue-iot

0.7.11

1 of 8 See more

drogue-cloud-metrics drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	no fix listed

Open the chart page →

13,558

upgrade-responderepinio

0.2.0

1 of 5 See more

upgrade-responder epinio 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :10.1.5	0679e877ba20	github.com/grafana/grafana@v0.0.0-20231011162216-849c612fcb73	1.9.2-0.20260323180334-daffe750de85

Open the chart page →

7,329

pyroscope-monitoringgrafana

0.1.1

1 of 6 See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/grafana/grafana@v0.0.0-20250812085420-df5de8219b41+dirty	1.9.2-0.20260323180334-daffe750de85

Open the chart page →

8,188

routergroundcover

1.12.357

1 of 7 See more

router groundcover 1.12.357

1 of the 7 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/grafana/grafana@v11.3.7	no fix listed

Open the chart page →

6,009

grafanakubeblocks

6.59.4

1 of 1 See more

grafana kubeblocks 6.59.4

1 of the 1 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :10.1.1	1b9ca4bbc4a2	github.com/grafana/grafana@v0.0.0-20230830192226-0cfa76b22dd5	1.9.2-0.20260323180334-daffe750de85

Open the chart page →

3,561

deepflowkubesphere-stable

6.2.606

1 of 8 See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :9.5.2	39c849cebccc	github.com/grafana/grafana@v9.5.2	no fix listed

Open the chart page →

18,316

grafananodepulse

7.1.0

1 of 1 See more

grafana nodepulse 7.1.0

1 of the 1 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :10.2.3	6b5b37eb35bb	github.com/grafana/grafana@v0.0.0-20231218140301-1e84fede543a	1.9.2-0.20260323180334-daffe750de85

Open the chart page →

2,966

lensoci-ai-incubations

0.1.14

1 of 16 See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
grafana/grafana :12.1.1	a1701c218024	github.com/grafana/grafana@v0.0.0-20250812085420-df5de8219b41+dirty	1.9.2-0.20260323180334-daffe750de85

Open the chart page →

17,070

archive-analysispcp-helm-charts

1.0.1

1 of 1 See more

archive-analysis pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	github.com/grafana/grafana@v10.2.6	no fix listed

Open the chart page →

1,326

npre-essentialsphntom

0.1.60

1 of 22 See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	no fix listed

Open the chart page →

26,840

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/grafana/grafana@v9.5.6	no fix listed

Open the chart page →

10,134

grafanasvtech-public-helm-charts

1.0.0

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-21724.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	github.com/grafana/grafana@v9.5.6	no fix listed

Open the chart page →

10,902

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	no fix listed	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	github.com/grafana/grafana@v9.5.6	no fix listed	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	no fix listed	2
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/grafana/grafana@v11.3.1	no fix listed	1
grafana/grafana :10.1.5	0679e877ba20	github.com/grafana/grafana@v0.0.0-20231011162216-849c612fcb73	1.9.2-0.20260323180334-daffe750de85	1
grafana/grafana :9.4.7	1a359d92f40e	github.com/grafana/grafana@v9.4.7	no fix listed	1
grafana/grafana :10.1.1	1b9ca4bbc4a2	github.com/grafana/grafana@v0.0.0-20230830192226-0cfa76b22dd5	1.9.2-0.20260323180334-daffe750de85	1
grafana/grafana :9.5.2	39c849cebccc	github.com/grafana/grafana@v9.5.2	no fix listed	1
grafana/grafana :10.2.3	6b5b37eb35bb	github.com/grafana/grafana@v0.0.0-20231218140301-1e84fede543a	1.9.2-0.20260323180334-daffe750de85	1
grafana/grafana :9.4.3	76dcf36e7d2a	github.com/grafana/grafana@v9.4.3	no fix listed	1
grafana/grafana :12.1.1	a1701c218024	github.com/grafana/grafana@v0.0.0-20250812085420-df5de8219b41+dirty	1.9.2-0.20260323180334-daffe750de85	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/grafana/grafana@v0.0.0-20250812085420-df5de8219b41+dirty	1.9.2-0.20260323180334-daffe750de85	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	github.com/grafana/grafana@v9.5.6	no fix listed	1
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	github.com/grafana/grafana@v10.2.6	no fix listed	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/grafana/grafana@v11.3.7	no fix listed	1