Greater than 46,000 internet-facing Grafana cases stay unpatched and uncovered to a client-side open redirect vulnerability that permits executing a malicious plugin and account takeover.
The flaw is tracked as CVE-2025-4123 and impacts a number of variations of the open-source platform used for monitoring and visualizing infrastructure and utility metrics.
The vulnerability was found by bug bounty hunter Alvaro Balada and was addressed in safety updates that Grafana Labs launched on Could 21.
Nonetheless, as of scripting this, greater than a 3rd of all Grafana cases reachable over the general public web haven’t been patched, in keeping with researchers at aplication safety firm OX Safety, who check with the bug as ‘The Grafana Ghost’.
The analysts informed BleepingComputer that their work targeted on demonstrating the flexibility to weaponize Balada’s discovering.
After figuring out variations susceptible to the assault, they assesed the publicity by correlating the information with the platform’s distribution throughout the ecosystem.
They discovered 128,864 cases uncovered on-line, with 46,506 nonetheless working susceptible variations that may nonetheless be exploited. This corresponds to a share of about 36%.
Supply: BleepingComputer
OX Safety’s in-depth evaluation of CVE-2025-4123 uncovered that, by a sequence of exploitation steps combining client-side path traversal with open redirect mechanics, attackers can lure victims into clicking URLs that result in loading a malicious Grafana plugin from a website managed by the risk actor.
The malicious hyperlinks could possibly be used to execute arbitrary JavaScript within the consumer’s browser, the researchers say.
Supply: OX Safety
The exploit doesn’t require elevated privileges and might operate even when nameless entry is enabled.
The flaw permits attackers to hijack consumer classes, change account credentials, and, in instances the place the Grafana Picture Renderer plugin is put in, carry out server-side request forgery (SSRF) to learn inner assets.
Whereas the default Content material Safety Coverage (CSP) in Grafana gives some safety, it doesn’t stop exploitation because of limitations in client-side enforcement.
OX Safety’s exploit demonstrates that CVE-2025-4123 could be exploited client-side and could possibly be leveraged to bypass trendy browser normalization mechanisms by by JavaScript routing logic native to Grafana.
This enables attackers to use URL dealing with inconsistencies to serve malicious plugins, which in flip modify consumer e-mail addresses, making account hijacking by way of password resets trivial.
Though CVE-2025-4123 has a number of exploitation necessities, like consumer interplay, an lively consumer session when the sufferer clicks the hyperlink, and having the plugin function enabled (is enabled by default), the big variety of uncovered cases and the shortage for want of authentication create a big assault floor.
To mitigate the chance of exploitation, it is strongly recommended that Grafana directors improve to variations 10.4.18+security-01, 11.2.9+security-01, 11.3.6+security-01, 11.4.4+security-01, 11.5.4+security-01, 11.6.1+security-01, and 12.0.0+security-01.
Patching used to imply complicated scripts, lengthy hours, and countless hearth drills. Not anymore.
On this new information, Tines breaks down how trendy IT orgs are leveling up with automation. Patch sooner, cut back overhead, and concentrate on strategic work — no complicated scripts required.
