CVE-2026-9703: CWE-284 in Grafana Grafana Enterprise

The vulnerability in Grafana's data source proxy (CWE-284) allows authenticated users with Viewer role to bypass intended access controls and send POST, PUT, and DELETE requests to the Loki rules API endpoint (/loki/api/v1/rules). This enables unauthorized creation, modification, or deletion of Loki alerting rules, impacting all users of the affected Loki data source. The flaw exists in Grafana versions from 8.0.0 through 13.0.3 across multiple sub-versions as specified. Loki itself is not vulnerable and does not require patching. No known exploits are reported in the wild.

An attacker with only Viewer-level access on a vulnerable Grafana instance can alter Loki alerting rules, which affects all users of the Loki data source. This can lead to unauthorized changes in alerting behavior, potentially disrupting monitoring and incident response processes. The vulnerability does not impact confidentiality but has high integrity impact and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided, users should monitor Grafana's official advisories for updates. In the meantime, restrict Viewer role assignments to trusted users and consider limiting access to Loki data sources where possible. Note that Loki itself is not vulnerable and does not require patching.