dbcve.org
GrafanaApplication

CVE-2022-31107

HIGH · 7.5 CVSS v3.1 Published 2022-07-15
Fix available
A fix is available. Upgrade to 8.3.10 / 8.4.10 or later.
See remediation →
81/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Grafana versions 5.3 through 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain an OAuth account takeover vulnerability. When OAuth is configured, a malicious user with valid OAuth credentials can hijack another user's account by setting their OAuth provider username to match the target Grafana username, provided their external user ID and email are not already linked to any Grafana account. This works because the login flow incorrectly links external OAuth users to existing internal accounts based solely on username matching.

MitigationUpgrade Grafana to version 9.0.3, 8.5.9, 8.4.10, or 8.3.10. Alternatively, disable OAuth login or ensure all authorized OAuth users have corresponding Grafana accounts already linked to their email addresses.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
GrafanaApplication
Affected:>= 5.3.0, < 8.3.10>= 8.4.0, < 8.4.10>= 8.5.0, < 8.5.9>= 9.0.0, < 9.0.3
E Series Performance AnalyzerApplication
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Grafana version
    Run 'grafana-server --version' or check the Grafana logs at startup, or inspect the grafana-server binary metadata
    Affected if The version falls within 5.3.0 to 8.3.9, 8.4.0 to 8.4.9, 8.5.0 to 8.5.8, or 9.0.0 to 9.0.2
  2. Verify OAuth provider configuration
    Inspect the grafana.ini configuration file (commonly in /etc/grafana/ or /usr/local/etc/grafana/) and look for sections under [auth] such as [auth.oauth] or provider-specific sections like [auth.google], [auth.github], etc.
    Affected if OAuth providers are configured and enabled under any [auth.<provider>] section
  3. Confirm no email linking enforcement exists
    In the OAuth provider configuration section, check if the 'connect_attributes' or 'email_attribute_path' settings explicitly link users by email rather than allowing username-only matching
    Affected if No strict email linkage is configured and the OAuth provider allows username matching to map to existing Grafana accounts
  4. Check for existing vulnerable user links
    Query the Grafana database (user_auth or user_auth_token tables) or examine the OAuth login logs to identify accounts linked via OAuth where the external user ID and email are not already linked
    Affected if OAuth-linked accounts exist that were created through username matching without email verification

You are affected if you run a vulnerable Grafana version (5.3.0 through 8.3.9, 8.4.0 through 8.4.9, 8.5.0 through 8.5.8, or 9.0.0 through 9.0.2) with OAuth authentication enabled and without enforced email-based account linking.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 8.3.10 / 8.4.10 / 8.5.9 or later
Fixed in 8.3.108.4.108.5.9
Interim mitigation

Upgrade Grafana to version 9.0.3, 8.5.9, 8.4.10, or 8.3.10. Alternatively, disable OAuth login or ensure all authorized OAuth users have corresponding Grafana accounts already linked to their email addresses.

Recommended fix High confidence

Grafana 9.0.3 or later (or 8.5.9/8.4.10/8.3.10 depending on your current major.minor branch)

  1. 1. Identify current Grafana version by running `grafana-cli --version` or checking the Grafana UI (click Help > About)
  2. 2. Based on current version, upgrade to the appropriate patched version:
  3. - If running 8.3.x: upgrade to 8.3.10 or later
  4. - If running 8.4.x: upgrade to 8.4.10 or later
  5. - If running 8.5.x: upgrade to 8.5.9 or later
  6. - If running 9.0.x: upgrade to 9.0.3 or later
  7. 3. For E Series Performance Analyzer (all versions): There is no patch available; migrate to an alternative solution or implement strict network access controls
  8. 4. After upgrade, verify OAuth configuration and test login flow
Caveat Review Grafana release notes for breaking changes between your current version and target version; major version upgrades (e.g., 8.x to 9.x) may include breaking changes requiring configuration adjustments

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Grafana Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA1.0 h
10.0 hours of engineering $1,800
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,880.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-31107 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-31107 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data