Greater than 46,000 internet-facing Grafana situations stay unpatched and uncovered to a client-side open redirect vulnerability that enables executing a malicious plugin and account takeover.
The flaw is tracked as CVE-2025-4123 and impacts a number of variations of the open-source platform used for monitoring and visualizing infrastructure and software metrics.
The vulnerability was found by bug bounty hunter Alvaro Balada and was addressed in security updates that Grafana Labs launched on Could 21.
Nonetheless, as of scripting this, greater than a 3rd of all Grafana situations reachable over the general public web haven’t been patched, in line with researchers at aplication security firm OX Safety, who seek advice from the bug as ‘The Grafana Ghost’.
The analysts instructed BleepingComputer that their work centered on demonstrating the power to weaponize Balada’s discovering.
After figuring out variations susceptible to the assault, they assesed the publicity by correlating the information with the platform’s distribution throughout the ecosystem.
They discovered 128,864 situations uncovered on-line, with 46,506 nonetheless working susceptible variations that may nonetheless be exploited. This corresponds to a proportion of about 36%.
Supply: BleepingComputer
OX Safety’s in-depth evaluation of CVE-2025-4123 uncovered that, by means of a collection of exploitation steps combining client-side path traversal with open redirect mechanics, attackers can lure victims into clicking URLs that result in loading a malicious Grafana plugin from a website managed by the risk actor.
The malicious hyperlinks might be used to execute arbitrary JavaScript within the consumer’s browser, the researchers say.
Supply: OX Safety
The exploit doesn’t require elevated privileges and may operate even when nameless entry is enabled.
The flaw permits attackers to hijack consumer periods, change account credentials, and, in circumstances the place the Grafana Picture Renderer plugin is put in, carry out server-side request forgery (SSRF) to learn inside assets.
Whereas the default Content material Safety Coverage (CSP) in Grafana gives some safety, it doesn’t stop exploitation on account of limitations in client-side enforcement.
OX Safety’s exploit demonstrates that CVE-2025-4123 may be exploited client-side and might be leveraged to bypass trendy browser normalization mechanisms by by means of JavaScript routing logic native to Grafana.
This permits attackers to take advantage of URL dealing with inconsistencies to serve malicious plugins, which in flip modify consumer electronic mail addresses, making account hijacking through password resets trivial.
Though CVE-2025-4123 has a number of exploitation necessities, like consumer interplay, an lively consumer session when the sufferer clicks the hyperlink, and having the plugin characteristic enabled (is enabled by default), the big variety of uncovered situations and the shortage for want of authentication create a major assault floor.
To mitigate the chance of exploitation, it’s endorsed that Grafana directors improve to variations 10.4.18+security-01, 11.2.9+security-01, 11.3.6+security-01, 11.4.4+security-01, 11.5.4+security-01, 11.6.1+security-01, and 12.0.0+security-01.
Patching used to imply advanced scripts, lengthy hours, and countless hearth drills. Not anymore.
On this new information, Tines breaks down how trendy IT orgs are leveling up with automation. Patch sooner, scale back overhead, and deal with strategic work — no advanced scripts required.
