{"id":"EUVD-2026-16596","revision":"92f0c4e194b843a6957e4e8d16f31e55","records":[{"revision":"92f0c4e194b843a6957e4e8d16f31e55","observedAt":"2026-11-10T02:09:19.735+00:00","statement":{"source":"euvd","id":"EUVD-2026-16596","aliases":["CVE-2026-27877","GHSA-3q27-7qjq-p9c5"],"title":"When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.","description":"When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.\n\nNo passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://grafana.com/security/security-advisories/cve-2026-27877"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16596","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 27, 2026, 2:02:11 PM","dateUpdated":"Aug 27, 2026, 5:22:48 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-13465","CVE-2025-3415","CVE-2025-61140","CVE-2026-1615","CVE-2026-21720","CVE-2026-21721","CVE-2026-21722","CVE-2026-21724","CVE-2026-21725","CVE-2026-25547","CVE-2026-26958","CVE-2026-27606","CVE-2026-27876","CVE-2026-27877","CVE-2026-27879","CVE-2026-28375","CVE-2026-33186"]},{"id":"RHSA-2026:10226","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877"]},{"id":"RHSA-2026:19352","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877","CVE-2026-32282","CVE-2026-32283"]},{"id":"openSUSE-SU-2026:10601-1","title":"grafana-11.6.14+security01-1.1 on GA media","vulnerabilityIds":["CVE-2026-21720","CVE-2026-21721","CVE-2026-21722","CVE-2026-21724","CVE-2026-21725","CVE-2026-26958","CVE-2026-27876","CVE-2026-27877","CVE-2026-27879","CVE-2026-28375","CVE-2026-33186","CVE-2026-33375"]},{"id":"RHSA-2026:11416","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877"]},{"id":"RHSA-2026:11417","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877"]},{"id":"SUSE-SU-2026:2243-1","title":"Security update 5.0.8 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2022-21698","CVE-2025-29923","CVE-2026-21724","CVE-2026-21725","CVE-2026-26958","CVE-2026-27606","CVE-2026-27876","CVE-2026-27877","CVE-2026-27879","CVE-2026-28375","CVE-2026-33186","CVE-2026-33375","CVE-2026-34986","CVE-2026-40179","CVE-2026-41602","CVE-2026-42151","CVE-2026-42154"]},{"id":"RHSA-2026:10223","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877"]},{"id":"SUSE-SU-2026:2258-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2025-29923","CVE-2026-21724","CVE-2026-21725","CVE-2026-26958","CVE-2026-27876","CVE-2026-27877","CVE-2026-27879","CVE-2026-28375","CVE-2026-33186","CVE-2026-33375","CVE-2026-34986","CVE-2026-41602"]},{"id":"RHSA-2026:19134","title":"Red Hat Security Advisory: grafana security update","vulnerabilityIds":["CVE-2026-27877","CVE-2026-32282","CVE-2026-32283"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-16596","identifiers":["EUVD-2026-16596","CVE-2026-27877","GHSA-3q27-7qjq-p9c5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}