CVE-2026-12593

Executive Summary

CVE-2026-12593 is a critical authorization bypass vulnerability in Grafana’s internal and undocumented Dashboard API endpoint POST /api/users/~/{user}/tokens. The flaw allows an authenticated attacker with OAuth/OIDC credentials to forge a token creation request on behalf of another internal user, potentially escalating privileges to Dashboard Administrator. In the worst case, combined with another weakness, this could lead to remote code execution on the host system. No public exploit or patch is currently available, but the vulnerability is considered high severity due to the potential for full administrative takeover.

Supply Chain & Package Security

Grafana is a widely used open-source analytics and monitoring platform. This vulnerability affects the core server component, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Grafana in containerized or orchestrated environments should verify their deployment’s authentication and authorization configurations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid OAuth/OIDC credentials.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – Exploit stays within the same security authority.
• Confidentiality (C): High (H) – Full read access to all data.
• Integrity (I): High (H) – Full write access to all data.
• Availability (A): High (H) – Full control over system availability.

CVSS Score: 8.8 (High)
Threat Level: Critical – Immediate attention required.

Deep Dive & Mechanics

The vulnerability resides in the undocumented API endpoint POST /api/users/~/{user}/tokens. This endpoint is intended for internal use to create API tokens for other users, but it fails to enforce proper authorization checks. Specifically, it does not verify that the requesting user has sufficient privileges to create a token for the target user.

Attack Flow:

1. Precondition: A preexisting internal user (e.g., admin) with higher privileges exists, and the attacker knows their login name.
2. Authentication: The attacker authenticates to the Grafana Dashboard via OAuth/OIDC.
3. Forgery: The attacker sends a forged POST /api/users/~/{user}/tokens request, specifying the target user’s login name.
4. Token Creation: The endpoint creates an API token for the target user, but the attacker finalizes the token creation using their own OAuth/OIDC credentials.
5. Escalation: The attacker now possesses an API token with the privileges of the target user. If the target user is an administrator, the attacker gains full administrative control.
6. Code Execution (Worst Case): Combined with another weakness (e.g., a file upload or command injection), the attacker could execute arbitrary code on the host system.

Root Cause: Missing authorization check in the POST /api/users/~/{user}/tokens handler. The code does not verify that the authenticated user has the Admin role or the org:users:token:create permission for the target user.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (h *DashboardAPI) CreateUserToken(c *models.ReqContext) {
    targetUser := c.Params(":user")
    // Missing authorization check
    token, err := h.TokenService.CreateToken(targetUser)
    if err != nil {
        c.JSON(500, map[string]string{"error": err.Error()})
        return
    }
    c.JSON(200, token)
}

Patched Code (Conceptual):

func (h *DashboardAPI) CreateUserToken(c *models.ReqContext) {
    targetUser := c.Params(":user")
    // Authorization check: only admins can create tokens for other users
    if !c.SignedInUser.HasRole(roles.Admin) {
        c.JSON(403, map[string]string{"error": "Forbidden"})
        return
    }
    token, err := h.TokenService.CreateToken(targetUser)
    if err != nil {
        c.JSON(500, map[string]string{"error": err.Error()})
        return
    }
    c.JSON(200, token)
}

Key Difference: The patched version adds a role check (c.SignedInUser.HasRole(roles.Admin)) before allowing token creation for another user.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Grafana version: 9.x (vulnerable)
• OAuth/OIDC provider: Keycloak or Okta
• Target user: admin (known login name)
• Attacker user: attacker (authenticated via OAuth)

Exploitation Steps:

1. Authenticate as attacker via OAuth/OIDC.
2. Obtain a valid session cookie or bearer token.
3. Send a forged request to create a token for admin:

   curl -X POST "https://grafana.example.com/api/users/~{admin}/tokens" \
     -H "Authorization: Bearer <attacker_token>" \
     -H "Content-Type: application/json" \
     -d '{"name": "malicious_token"}'
   

4. The endpoint returns a new API token for admin.
5. Use the token to perform administrative actions:

   curl -X GET "https://grafana.example.com/api/admin/users" \
     -H "Authorization: Bearer <admin_token>"
   

Expected Outcome: Full administrative access to Grafana.

Blue Team (Defensive)

Detection:

• Monitor for unusual API calls to /api/users/~{user}/tokens from non-admin users.
• Alert on token creation events where the creator and target user differ.
• Review OAuth/OIDC authentication logs for anomalous patterns.

Mitigation:

• Apply vendor patch immediately when available.
• Restrict OAuth/OIDC access to trusted identity providers only.
• Implement network segmentation to limit exposure of Grafana API endpoints.
• Enable audit logging for all token creation operations.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/users/~{user}/tokens from non-admin users.
  • Unusual API token usage patterns (e.g., tokens created for admin users by non-admin accounts).
• Logs:
  • Grafana audit logs showing token creation events with mismatched creator and target user.
  • OAuth/OIDC authentication logs with repeated failed attempts followed by successful token creation.
• System:
  • Unexpected API tokens in Grafana’s token store.
  • Unauthorized configuration changes or data access.

Detection Engineering

YARA Rule

rule grafana_cve_2026_12593_token_bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2026-12593 in Grafana logs"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $token_endpoint = "/api/users/~"
        $token_creation = "POST"
        $admin_user = "admin"
    condition:
        $token_endpoint and $token_creation and $admin_user
}

Sigma Rule

title: Grafana CVE-2026-12593 Token Creation Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized API token creation for another user in Grafana
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: grafana
detection:
    selection:
        http_method: 'POST'
        url_path: '/api/users/~*'
    condition: selection
falsepositives:
    - Legitimate admin token creation
level: high

Suricata Rule

alert http any any -> any any (
    msg:"Grafana CVE-2026-12593 Token Creation Bypass";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/api/users/~";
    http_uri;
    content:"/tokens";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the undocumented API endpoint if possible (e.g., via reverse proxy rules).
   • Restrict OAuth/OIDC access to trusted identity providers only.
   • Implement network segmentation to limit exposure of Grafana API endpoints.

2. Long-term Fix:

   • Apply vendor patch when released.
   • Upgrade to a patched version of Grafana.
   • Review and harden all API authorization checks.

3. Monitoring:

   • Enable audit logging for all token creation operations.
   • Set up alerts for unauthorized API calls to /api/users/~{user}/tokens.
   • Regularly review Grafana logs for suspicious activity.

4. Best Practices:

   • Follow the principle of least privilege for all users.
   • Use multi-factor authentication for OAuth/OIDC.
   • Regularly audit user roles and permissions.

Valters IT