CVE-2026-15815

Estado: Pendiente de análisisAlta (8.8)—

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Leer descripción completaMostrar menos

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.69%
Percentil entre todas las CVEs puntuadas: 51
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution85 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1574.008 Path Interception by Search Order Hijackingstealth · execution80 %

Explotación mediante descarga e instalación de plugin malicioso (requiere interacción UI); ejecución remota de código ejecutable con privilegios del proceso Grafana; manipulación de symlinks para hijacking de carga de binarios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Audit Restrict Web-Based Content Restrict File and Directory Permissions Privileged Account Management Limit Software Installation

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — Grafana Enterprise^AI Grafana — Grafana OSS^AI

CWE

CWE-22, CWE-59, CWE-94

Referencias

https://grafana.com/security/security-advisories/cve-2026-15815

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-15815",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15815",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-18T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.6.17"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.4.10"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.0.8"
            },
            {
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.1.5"
            },
            {
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.2.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Grafana",
          "product": "Grafana Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.6.17"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.4.10"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.0.8"
            },
            {
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.1.5"
            },
            {
              "status": "affected",
              "version": "13.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.2.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-17T21:17:11.210",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-15815",
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a plugin from an\narbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or\npreinstall configuration.\n\nGrafana Enterprise is affected because it includes the same plugin extraction code as\nGrafana OSS."
    }
  ],
  "lastModified": "2026-09-19T04:17:53.427",
  "sourceIdentifier": "security@grafana.com"
}