---
title: "Grafana snapshot auth bypass (CVE-2021-39226)"
canonical: https://trickest.com/library/cve-2021-39226-grafana-snapshot-auth-bypass
description: "Flag Grafana hosts for CVE-2021-39226 by reading version from GET /api/health. Floors 7.5.11 / 8.1.6. No snapshot GET, delete, or data disclosure."
---

# Grafana snapshot auth bypass (CVE-2021-39226)

## Overview

This workflow finds Grafana and sorts each host by whether its version falls below the CVE-2021-39226 fixed floors. CVE-2021-39226 is an authentication bypass on snapshot endpoints that can expose snapshot data on vulnerable builds. This check never GETs a snapshot, never deletes one, and never reads dashboard data. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/api/health`, fingerprints Grafana from the health JSON, parses the `version` field, and compares it to the per-branch floors in the graph: 7.5.11 and 8.1.6. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no snapshot auth-bypass confirm.

Run it on a schedule when observability stacks change. A 8.0.x Grafana that missed 8.1.6 is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/api/health` on each host and fingerprint Grafana from the health JSON that includes a `version` field.
3. Parse the version and compare it to the CVE-2021-39226 per-branch floors in the graph (7.5.11 and 8.1.6).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Grafana was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/api/health` only. No snapshot GET, no snapshot delete, and no data disclosure probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one Grafana host below a CVE-2021-39226 floor, one at or above its branch floor, and one host that is not the product.

```jsonl
{"url": "https://grafana.example.com", "is_product": true, "product_version": "8.1.2", "vulnerable": true, "detail": "below branch floor 8.1.6"}
{"url": "https://grafana.example.org", "is_product": true, "product_version": "8.1.6", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Grafana"}
```

```json
{"cve": "CVE-2021-39226", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Grafana versions does this flag?

Builds below the per-branch floors in the graph: 7.5.11 (7.x and earlier) and 8.1.6 (8.x). A version picks the matching band, then compares to that band's floor. The compare uses the version `/api/health` itself served.

### Does an affected row mean snapshot data was read?

No. The check only GETs `/api/health` and reads `version`. It does not GET or delete a snapshot and it does not disclose dashboard data.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public health endpoint. It does not log in or touch snapshots.

### Does the check need credentials?

No. It fingerprints `/api/health` the way an external scanner would.

### What is CVE-2021-39226?

Authentication bypass on Grafana snapshot endpoints that can expose snapshot data on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Grafana path traversal CVE-2021-43798 (plugin file read)](/library/grafana-path-traversal-cve-2021-43798). Reach for it when you need the companion Grafana plugin path-traversal check.
- [ManageEngine DC auth bypass (CVE-2021-44515)](/library/cve-2021-44515-manageengine-desktop-central-auth-bypass-rce). Reach for it when the next ops-console flag is Desktop Central auth bypass, not Grafana.

---
_Markdown source of https://trickest.com/library/cve-2021-39226-grafana-snapshot-auth-bypass._