CVE-2026-21722 describes a vulnerability in Grafana where public dashboards with annotations enabled do not restrict annotation timeranges to the locked timerange of the dashboard. This allows an attacker or user to read the entire history of annotations visible on that dashboard, including those outside the locked timerange. Importantly, no annotations that are not otherwise visible on the public dashboard are leaked. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No known exploits are reported in the wild. The affected versions explicitly include 9.3.0, 12.0.0, 12.2.0, and 12.3.0. No patch or remediation information is provided in the source data.

The vulnerability allows unauthorized users to access the full history of annotations on public dashboards beyond the intended locked timerange. However, it does not expose any annotations that are not already visible on the public dashboard, limiting the confidentiality impact to information already accessible. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Grafana's official channels for updates. In the meantime, consider restricting public dashboard access or disabling annotations if feasible to reduce exposure.