VulnSocial

CVE-2026-15815Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-59CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-16); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-16: 1Mentions · 2026-10-02: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-10-02: 109-1610-02
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-09-161
Patch1
2026-10-021
Disclosure1
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH SEVERITY: CVE-2026-15815 (CVSS 8.8) Grafana OSS & Enterprise vulnerable to RCE via malicious plugin archives. Symlink traversal allows arbitrary file writes & code execution with server privileges. Affects plugin installs via grafana-cli & env vars. https://t.co/AAcw3cGivb

    Post summary

    Tweet announces CVE-2026-15815 (CVSS 8.8) affecting Grafana OSS/Enterprise via symlink traversal in plugin archives enabling RCE, but provides no PoC, exploit tool, active exploitation claims, or patch information within the tweet text itself.

    0000057
    144 followersView on X
  • 0xdevshm@0xdevshm
    Patch

    Grafana v13.2.2 is out. - Security: Fix CVE-2026-15815 - Security: Fix CVE-2026-76154 https://github.com/grafana/grafana/releases/tag/v13.2.2 #grafana #release #programming

    Post summary

    The text announces the Grafana v13.2.2 release which patches two security CVEs (CVE-2026-15815 and CVE-2026-76154), linking to the GitHub release page.

    0000044
    129 followersView on X

Explore more

Back to dashboard