What this checks: whether a Grafana host runs a version affected by unauth snapshot authentication bypass. Read-only: it fingerprints Grafana and reads the version, no exploitation.
3. Detection — reads the Grafana version from the version exposed at /api/health, compares to 7.5.11 (7.x and earlier); 8.1.6 (8.x branch). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Grafana URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Grafana and sorts each host by whether its version falls below the CVE-2021-39226 fixed floors. CVE-2021-39226 is an authentication bypass on snapshot endpoints that can expose snapshot data on vulnerable builds. This check never GETs a snapshot, never deletes one, and never reads dashboard data. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /api/health, fingerprints Grafana from the health JSON, parses the version field, and compares it to the per-branch floors in the graph: 7.5.11 and 8.1.6. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no snapshot auth-bypass confirm.
Run it on a schedule when observability stacks change. A 8.0.x Grafana that missed 8.1.6 is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /api/health on each host and fingerprint Grafana from the health JSON that includes a version field.
Parse the version and compare it to the CVE-2021-39226 per-branch floors in the graph (7.5.11 and 8.1.6).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Grafana was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /api/health only. No snapshot GET, no snapshot delete, and no data disclosure probe.
Sample output
The records below are illustrative and do not come from a real run. They show one Grafana host below a CVE-2021-39226 floor, one at or above its branch floor, and one host that is not the product.
Builds below the per-branch floors in the graph: 7.5.11 (7.x and earlier) and 8.1.6 (8.x). A version picks the matching band, then compares to that band's floor. The compare uses the version /api/health itself served.
Does an affected row mean snapshot data was read?
No. The check only GETs /api/health and reads version. It does not GET or delete a snapshot and it does not disclose dashboard data.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public health endpoint. It does not log in or touch snapshots.
Does the check need credentials?
No. It fingerprints /api/health the way an external scanner would.
What is CVE-2021-39226?
Authentication bypass on Grafana snapshot endpoints that can expose snapshot data on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.