CVE-2022-35957 - CVE House

Back to Database

Status published Medium CVE-2022-35957

Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

6.6 CVSS

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35957

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from grafana

View All →

Stored XSS in Grafana Text plugin

Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information

Access policy with access to all tenants and using label selectors has more access

Grafana vulnerable to race condition allowing privilege escalation

Grafana vulnerable to spoofing originalUrl of snapshots

Affected Vendor

grafana

View all reports →

Affected Software

grafana

Vulnerable Versions:

> 9.0.0, < 9.1.6, < 8.5.13

Timeline

Official Publish: September 20th, 2022

Last Modified: January 28th, 2026

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1190 Exploit Public-Facing Application