CVE-2026-22639

216.73.216.133

· Published 15/01/2026 14:16 · Modified 16/01/2026 15:55

Labels: CVE-2026-22639 2026-01-15 CVE-2026-22639 CWE-200 [email protected]

Essential information

Published: 15/01/2026 14:16
Modified: 16/01/2026 15:55
Author: —
Creator: —
CVSS: 4.3 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS metrics

Description

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
grafana / grafana	`cpe:2.3:a:grafana:grafana:10.4.19+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:11.2.10+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:11.3.7+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:11.4.5+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:11.5.5+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:11.6.2+security-01:::::::*`
grafana / grafana	`cpe:2.3:a:grafana:grafana:12.0.1+security-01:::::::*`