CVE-2026-13720

Executive Summary

CVE-2026-13720 is an improper authorization vulnerability (CWE-285) in Grafana in which a user holding the low-privileged Editor role can set file-provisioning metadata annotations (grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath) while creating a dashboard through the dashboard API. Because these fields are stored without an authorization check, the resulting dashboard is treated as file-provisioned, and administrators can no longer update or delete it through Grafana.

The impact is confined to the same organization; no data is exposed, and there is no confidentiality impact. The primary consequence is a persistent integrity and availability degradation of dashboard management within the affected Grafana instance, particularly for administrators who lose the ability to remediate or remove the affected dashboard via the standard Grafana UI/API.

Technical Analysis

The vulnerability resides in the dashboard provisioning metadata model rather than in a memory-safety or injection flaw. Grafana supports "file provisioning," a workflow in which dashboards are authored as code (e.g., JSON files on disk) and loaded into Grafana by a provisioning mechanism. Provisioned dashboards are marked with annotations such as grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath. In a correctly functioning deployment, those annotations are owned and set by the provisioning subsystem, not by API callers, because Grafana deliberately treats provisioned dashboards as immutable by the UI/API — the source of truth is the file, not the API.

CVE-2026-13720 arises because the dashboard creation API path stores these provisioning annotation fields without performing an authorization check on the caller. An authenticated user with the Editor role has permission to create dashboards, but should not be permitted to set provisioning metadata, which is a privileged, configuration-level attribute. The authorization check that should prevent an unprivileged user from setting these server-owned fields is missing.

The result is a state-confusion condition: a dashboard created by an Editor through the API carries the same provisioning markers as one loaded from a file. Grafana's internal logic then treats the dashboard as file-provisioned, and administrators can no longer update or delete it through Grafana. This is not privilege escalation, not remote code execution, and not an information-disclosure bug — it is an unauthorized modification of object metadata (integrity, C:N/I:L) that leads to a loss of administrative control over the affected object (availability, A:L).

CWE-285 (Improper Authorization) is the correct classification: the system fails to verify that the authenticated principal is authorized to set provisioning metadata before persisting it.

Notes on scope, per the source data: affected version ranges, packages, and the exact committing patch are unknown. This report does not assert specific Grafana release versions, function names, or source-file locations, because none are provided in the CNA/NVD data.

Exploitation Scenarios

The following attack chain is described strictly at the vulnerability-class level. No public PoC exists and no implementation specifics (function names, file paths, endpoint paths beyond the generic "dashboard API") are asserted beyond those present in the source description.

1. Reconnaissance / target identification. The attacker identifies a reachable Grafana instance and determines whether they can obtain an authenticated session. The attack requires a valid, low-privileged account holding the Editor role (PR:L, AV:N). In a typical scenario this is an insider, a compromised standard user, or a user who was granted Editor rights that are broader than intended. No unauthenticated access is required, and no user interaction is needed on the victim's behalf (UI:N).

2. Triggering the flaw class. Using the authenticated Editor session, the attacker issues a dashboard-creation request through the Grafana dashboard API. In the body of that request, the attacker includes the provisioning annotation fields — grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath. Because the server stores these fields without an authorization check, the request is accepted and the annotations are persisted, even though the caller lacks the authority to define provisioning metadata.

3. Payload / execution method (vulnerability class). There is no code execution payload. The "payload" is the set of provisioning annotations themselves. The unauthorized write of server-owned metadata is the exploitation primitive. This is a classic improper-authorization (CWE-285) issue: the security decision (may this caller set provisioning fields?) is not enforced, so the state change succeeds. No shell, script, or exploit binary is involved.

4. Post-exploitation impact. The newly created dashboard now appears file-provisioned. Grafana's provisioning logic consequently treats it as externally managed. Administrators can no longer update or delete it through Grafana via the normal administrative workflow. The attacker thereby achieves a low-severity, persistent denial of administrative control over that single object, within the same organization. Data is not exposed and confidentiality is not impacted, but the integrity of dashboard metadata has been altered and the availability of normal delete/update operations is degraded.

Because no public PoC is available, the precise request shape (HTTP method, endpoint path, exact JSON body) is inferred from the vulnerability class and the API described in the NVD text, not from observed exploit code.

Impact Assessment

The CVSS v3.1 base score is 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Interpreting the subscores:

• AV:N (Network) — the dashboard API is reachable over the network; no local access is needed.
• AC:L (Low) — no special conditions, race conditions, or unusual configuration are described; an Editor simply needs to include the fields in a creation request.
• PR:L (Low) — the attacker must hold a valid low-privileged (Editor) account.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — the impact remains within Grafana's own security scope.
• C:N (None) — no data is exposed, consistent with the source description.
• I:L (Low) — unauthorized modification of dashboard provisioning metadata.
• A:L (Low) — administrators lose the ability to update or delete the affected dashboard through Grafana.

Blast radius. Impact is limited to the same organization. It is not cross-tenant, and it is not a data breach. The practical business impact is operational: an administrator's ability to manage, fix, or remove a specific dashboard is impaired, and the object is held in a provisioned state that the standard UI cannot cleanly resolve. In environments with strict change-management requirements, a mislabeled "provisioned" dashboard can create confusion, delay remediation, and complicate dashboard lifecycle governance. Attacker value is proportional to how much friction this imposes on administrators, and multiple such dashboards could compound the effect, though each instance is low severity.

Exploitability. EPSS has not been scored by FIRST.org, and there is no public PoC, no Nuclei template, and no known exploit code. CISA KEV does not list this CVE, indicating no confirmed exploitation in the wild.

Detection Guidance

Sigma Rule

This rule detects a dashboard-creation API call that includes provisioning annotation markers in the request body — the signature of this improper-authorization write. Field names should be adapted to the deployment's log schema.

title: Grafana Dashboard Creation with File-Provisioning Annotations (CVE-2026-13720)
id: 8f3c1a24-6b2e-4f9a-9d1c-2e7a5c4b0d31
status: experimental
description: Detects an authenticated dashboard creation request that supplies grafana.app/managedBy, grafana.app/managerId, or grafana.app/sourcePath provisioning annotations, indicating abuse of CVE-2026-13720.
author: valtersit.com
date: 2026-01-01
logsource:
  product: grafana
  service: http
detection:
  selection_endpoint:
    http.method: 'POST'
    http.url|contains: '/api/dashboards'
  selection_annotations:
    http.request.body|contains:
      - 'grafana.app/managedBy'
      - 'grafana.app/managerId'
      - 'grafana.app/sourcePath'
  condition: selection_endpoint and selection_annotations
fields:
  - user.name
  - http.url
  - http.request.body
falsepositives:
  - Legitimate provisioning subsystem activity (should be attributable to the provisioning service account, not interactive Editors)
level: medium
tags:
  - attack.t1078
  - cve.2026.13720

YARA Rule

YARA is applied here to log or capture artifacts containing the provisioning annotation markers alongside dashboard-creation context.

rule CVE_2026_13720_Grafana_Provisioning_Annotation_Abuse
{
    meta:
        author = "valtersit.com"
        description = "Detects Grafana dashboard API artifacts carrying file-provisioning annotations abused via CVE-2026-13720"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13720"
        cve = "CVE-2026-13720"
        date = "2026-01-01"

    strings:
        $managed = "grafana.app/managedBy" ascii wide nocase
        $manager = "grafana.app/managerId" ascii wide nocase
        $source  = "grafana.app/sourcePath" ascii wide nocase
        $api     = "/api/dashboards" ascii wide nocase

    condition:
        uint32be(0) < 0x10000000 and
        ($api and 2 of ($managed, $manager, $source))
}

Suricata IDS Rule

Detects HTTP POST requests to the Grafana dashboard API whose body contains provisioning annotation markers.

alert http any any -> any any (msg:"CVE-2026-13720 Grafana Provisioning Annotation Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/dashboards"; http.request_body; content:"grafana.app/managedBy"; http.request_body; content:"grafana.app/managerId"; classtype:attempted-admin; reference:cve,2026-13720; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13720; metadata:affected_product Grafana, attack_target Server, deployment Perimeter, signature_severity Minor; sid:202613720; rev:1;)

Elastic Detection

EQL query correlating a dashboard-creation API request that carries provisioning annotation fields with the acting user and role.

http where
  http.request.method == "POST" and
  stringContains(http.request.url, "/api/dashboards") and
  (stringContains(http.request.body, "grafana.app/managedBy") or
   stringContains(http.request.body, "grafana.app/managerId") or
   stringContains(http.request.body, "grafana.app/sourcePath"))

Splunk SPL Query

index=grafana sourcetype=grafana:http OR sourcetype=grafana:access
| search http_method="POST" uri_path="/api/dashboards*"
| rex field=_raw "(?<ann_managed>grafana\.app/managedBy)"
| rex field=_raw "(?<ann_manager>grafana\.app/managerId)"
| rex field=_raw "(?<ann_source>grafana\.app/sourcePath)"
| where isnotnull(ann_managed) OR isnotnull(ann_manager) OR isnotnull(ann_source)
| stats count min(_time) as first_seen max(_time) as last_seen by user, src_ip, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="grafana,web,cve-2026-13720,">
  <rule id="202613720" level="8">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="uri_path" type="pcre2">^/api/dashboards</field>
    <match type="pcre2">grafana\.app/(managedBy|managerId|sourcePath)</match>
    <description>CVE-2026-13720: Grafana dashboard creation attempt with file-provisioning annotations</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>grafana_access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix, workaround, or affected-version mapping is available. No CISA KEV listing and no public exploit exist.

1) Immediate mitigations

• Restrict who holds the Editor role. Because exploitation requires only Editor privileges, reducing the Editor population to trusted users directly shrinks the attack surface (maps to PR:L).
• Audit existing dashboards for the grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath annotations. Compare the set of provisioned-marked dashboards against the actual provisioning source (files/CI). Any provisioned-marked dashboard with no corresponding provisioning source is suspect and should be investigated.
• Where feasible, apply network and reverse-proxy controls to limit who can reach the dashboard API, and enforce that provisioning metadata changes originate only from the provisioning pipeline or administrator identities.
• Monitor dashboard-creation API calls for the presence of provisioning annotation fields in the request body (see Detection Guidance).

2) Patch / upgrade steps

• No patched version or vendor advisory is currently available. Monitor Grafana's official security advisories and release notes for a fix referencing CVE-2026-13720.
• Until a fix ships, do not rely on an upgrade path; treat this as an unpatched condition and rely on the compensating controls above.
• Once a vendor fix is published, test upgrade in a staging environment, verify that Editor roles can no longer set provisioning annotations, and roll out to production.

3) Long-term hardening

• Adopt least privilege for dashboard roles and periodically review role assignments. Editors should not be the default for broad user populations.
• Treat dashboard provisioning metadata as server-owned, configuration-level data and validate this expectation after any Grafana upgrade.
• Incorporate provisioning-consistency checks into routine dashboard governance: reconcile "provisioned" dashboards against actual provisioning sources.
• Because prior provisioning-annotation handling issues have surfaced in the form of CVEs in adjacent products (e.g., Grafana provisioning annotation handling), maintain an ongoing watch for regression and follow-on CVEs in the same subsystem.

References

• NVD — CVE-2026-13720: https://nvd.nist.gov/vuln/detail/CVE-2026-13720
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• Grafana — Security advisories and release notes: https://grafana.com/security/security-advisories/
• FIRST.org — EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-13720 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns, public PoC, Nuclei template, or exploit-in-the-wild activity have been identified for this CVE as of the data available.