CVE-2021-43798
Grafana Path Traversal Vulnerability
Description
CVE-2021-43798 is a high-severity directory traversal vulnerability (CVSS 7.5) in Grafana, the widely used open-source monitoring and observability platform. Affecting Grafana versions 8.0.0-beta1 through 8.3.0 (excluding patched releases), the flaw allows an unauthenticated remote attacker to read arbitrary files from the server through a path traversal in the plugin URL path (/public/plugins/<plugin-id>/). This vulnerability is classified under CWE-22 (Path Traversal) and was originally disclosed as a 0-day exploit in December 2021. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 30, 2025, and its EPSS score of 94.44% (100th percentile) reflects near-certain exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| grafana | grafana | >= 8.0.1, < 8.0.7; >= 8.1.0, < 8.1.8; >= 8.2.0, < 8.2.7; 8.0.0; 8.3.0 |
References
- http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/12/09/2(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/10/4(Mailing List, Patch, Third Party Advisory)
- https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce(Patch, Third Party Advisory)
- https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p(Patch, Vendor Advisory)
- https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/(Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20211229-0004/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a vulnerability where software uses external input to construct a pathname for a file or directory, but does not properly neutralize special elements such as ../ sequences that can resolve to locations outside the intended restricted directory. In CVE-2021-43798, the Grafana web server fails to sanitize path components in the plugin static file serving route, allowing an attacker to use directory traversal sequences to escape the plugin directory and read arbitrary files from the underlying filesystem. This weakness class is especially dangerous in web applications because it can expose configuration files, credentials, database connection strings, and other sensitive data stored on the server.
Impact Analysis
The business impact of CVE-2021-43798 centers on the exposure of sensitive server-side data. Confidentiality is fully compromised because an unauthenticated attacker can read any file that the Grafana process has permission to access on the server filesystem. This commonly includes Grafana configuration files containing database credentials, API keys, LDAP bind passwords, SMTP credentials, and session signing secrets. On Linux systems, attackers can also read /etc/passwd, /etc/shadow (if Grafana runs as root), SSH private keys, and other system files. Integrity is not directly affected by this vulnerability since it only enables file reading, not writing. Availability is also not directly impacted, though the information gained could enable follow-on attacks that compromise integrity and availability.
With an EPSS score of 94.44% (100th percentile), this is one of the most actively exploited vulnerabilities in existence. It has been widely adopted by automated scanning tools, botnets, and threat actors worldwide. The KEV catalog entry with a due date of October 30, 2025 confirms sustained exploitation. While the ransomware association is listed as "Unknown," the credentials and secrets exposed through this vulnerability frequently serve as the initial foothold for ransomware attacks, as attackers use the harvested credentials to pivot to databases, cloud services, and internal systems. Grafana deployments often have access to sensitive infrastructure monitoring data, making this a high-value target for reconnaissance in targeted attacks.
Exploit Maturity
CVE-2021-43798 has an exceptionally mature and widespread exploitation profile. It was originally disclosed as a 0-day vulnerability in December 2021 and has been extensively exploited since. CISA's KEV catalog includes this vulnerability with a remediation deadline of October 30, 2025. The EPSS score of 94.44% (100th percentile) is the highest possible, indicating near-universal exploitation across the threat landscape.
Multiple public exploits are available. A proof-of-concept exploit was published on PacketStorm Security demonstrating the directory traversal attack against Grafana 8.3.0. The official Grafana security advisory (GHSA-8pjx-jj86-j47p) provides detailed vulnerability information, and the Grafana blog post documents the timeline and 0-day nature of the disclosure. Patches have been committed to the Grafana GitHub repository. The vulnerability is trivial to exploit—requiring only a crafted HTTP GET request—and has been incorporated into numerous automated exploitation frameworks. The ransomware status is "Unknown," but exposed credentials from Grafana servers are routinely used as pivot points in ransomware campaigns.
Remediation
-
Upgrade Grafana to a patched version immediately. Update to Grafana 8.0.7, 8.1.8, 8.2.7, or 8.3.1 (or any later release) depending on your current major.minor version. These patched versions fix the directory traversal vulnerability in the plugin static file serving route. Use your package manager or container image repository to deploy the update.
-
Rotate all credentials stored in Grafana configuration files. Because the vulnerability exposes server-side files including
grafana.iniand provisioning YAML files, assume that all credentials stored in these files have been compromised if your instance was exposed prior to patching. This includes database passwords, LDAP credentials, SMTP passwords, API keys, and the secret key used for signing cookies and tokens. -
Implement a web application firewall (WAF) or reverse proxy rule. Add rules to block HTTP requests containing directory traversal sequences (
../) in the/public/plugins/URL path. While this should not replace patching, it provides defense-in-depth against exploitation attempts targeting this specific path. -
Audit access logs for exploitation indicators. Search your Grafana access logs and reverse proxy logs for requests matching the pattern
/public/plugins/<any-plugin-id>/../../... Any matches indicate attempted or successful exploitation. Correlate with the files that may have been accessed to assess the scope of data exposure. -
Restrict network access to Grafana instances. Ensure that Grafana dashboards are not unnecessarily exposed to the public internet. Place Grafana behind VPN or authentication proxies, and limit access to authorized users and networks. Grafana Cloud was never affected by this vulnerability.
Technical Details
The CVSS v3.1 vector for CVE-2021-43798 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, resulting in a base score of 7.5 (High). Attack Vector (AV:N) indicates the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) confirms exploitation is trivial with no special conditions. Privileges Required (PR:N) means no authentication is needed—any anonymous user with network access can exploit the flaw. User Interaction (UI:N) specifies no victim action is required. Scope (S:U) indicates the impact stays within Grafana's security context. Confidentiality (C:H) is rated High because the attacker can read arbitrary files, while Integrity (I:N) and Availability (A:N) are not impacted since the vulnerability only enables reading, not writing or disruption.
The vulnerability exists in Grafana's HTTP routing for serving static plugin files. Grafana exposes a URL pattern /public/plugins/<plugin-id>/ that serves static assets (JavaScript, CSS, images) for installed plugins. The vulnerable code path does not properly sanitize the path component after the plugin ID, failing to strip or reject directory traversal sequences such as ../. An attacker can craft a request like /public/plugins/alertlist/../../../../../../../../etc/passwd to traverse out of the plugin directory and read arbitrary files from the server filesystem. The <plugin-id> can be any installed plugin, including default built-in plugins like alertlist, graph, or prometheus. Because no authentication is required to access the /public/plugins/ route, the attack can be performed by any network-reachable client. The Grafana team patched the vulnerability by implementing proper path sanitization that rejects requests containing traversal sequences before file resolution occurs.
Frequently Asked Questions
What is CVE-2021-43798?
CVE-2021-43798 is a critical directory traversal vulnerability in Grafana versions 8.0.0-beta1 through 8.3.0 that allows unauthenticated remote attackers to read arbitrary files from the server. The attack exploits insufficient path sanitization in the plugin static file serving route. Grafana Cloud was never affected by this vulnerability.
How is CVE-2021-43798 exploited?
Exploitation is trivially simple. An attacker sends an HTTP GET request to /public/plugins/<any-installed-plugin>/../../../../../../<target-file>, using directory traversal sequences to escape the plugin directory. No authentication, special tools, or user interaction is required—a standard web browser or curl command is sufficient.
Which Grafana versions are affected?
Grafana versions 8.0.0-beta1 through 8.3.0 are affected, excluding the patched releases 8.0.7, 8.1.8, 8.2.7, and 8.3.1. Versions prior to 8.0.0 are not affected. Grafana Cloud has never been vulnerable to this issue. Organizations should update to the latest available Grafana release.
What data can an attacker access through this vulnerability?
An attacker can read any file on the server that the Grafana process has permission to access. Common targets include Grafana configuration files (containing database credentials, LDAP passwords, API keys), system files like /etc/passwd, SSH keys, and other application configuration files. This makes credential rotation mandatory after patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.