CVE-2022-31107 [High] | Security Vulnerability in Grafana

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.94%	2.03%	+1.09%
2	2026-05-06	0.69%	0.94%	+0.25%
3	2026-04-19	—	0.69%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.94%

2.03%

+1.09%

2026-05-06

0.69%

0.94%

+0.25%

2026-04-19

—

0.69%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.1	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	1.6	5.5	[email protected]
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.1

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

1.6

5.5

[email protected]

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

5.9

[email protected]

OS Trackers for CVE-2022-31107

vendor	priority	summary	link
`alpine`	high	CVE-2022-31107: 1 source package rows (grafana); 25 state rows across 7 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 7, open 18.	https://security.alpinelinux.org/vuln/CVE-2022-31107
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2022-31107
`suse`	high	CVE-2022-31107 severity important: SUSE including 13 source package names (9.5.5.3.4.156:grafana-9.5.1-150200.3.41.3, grafana, …), 25 product×package rows across 24 product lines (Container ses/7.1/ceph/grafana, HPE Helion OpenStack 8, … (24 product lines)): Fixed 20, Will Not Fix 5.	https://www.suse.com/security/cve/CVE-2022-31107/
`ubuntu`	medium	CVE-2022-31107 medium priority: Ubuntu including 1 source packages (grafana), 9 status rows across 9 suites (focal, jammy, mantic, noble, oracular, plucky, questing, upstream, xenial): DNE 7, needs-triage 2.	https://ubuntu.com/security/CVE-2022-31107

Affected software / configurations for CVE-2022-31107

Vendor	Product	Version	Raw CPE
grafana	grafana	>= 5.3.0, < 8.3.10	cpe:2.3:a:grafana:grafana::::::::
grafana	grafana	>= 8.4.0, < 8.4.10	cpe:2.3:a:grafana:grafana::::::::
grafana	grafana	>= 8.5.0, < 8.5.9	cpe:2.3:a:grafana:grafana::::::::
grafana	grafana	>= 9.0.0, < 9.0.3	cpe:2.3:a:grafana:grafana::::::::
netapp	e-series_performance_analyzer	—	cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::*

References for CVE-2022-31107

URL	Tags
https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2	Release Notes Third Party Advisory
https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/	Release Notes Vendor Advisory
https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/	Release Notes Vendor Advisory
https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/	Release Notes Vendor Advisory
https://security.netapp.com/advisory/ntap-20220901-0010/	Third Party Advisory

URL

CVE-2022-31107 | Grafana account takeover via OAuth vulnerability

Exploit prediction scoring system (EPSS) score for CVE-2022-31107

Common vulnerability scoring system (CVSS) metrics for CVE-2022-31107

Weakness enumeration for CVE-2022-31107

GitHub Security Advisory for CVE-2022-31107

OS Trackers for CVE-2022-31107

Affected software / configurations for CVE-2022-31107

References for CVE-2022-31107