Hackers Exploit Grafana Vulnerability Allowing Arbitrary File Reads

Researchers at GreyNoise observed a surge in Grafana exploitation attempts tied to the well-known path traversal flaw CVE-2021-43798, which allows attackers to read arbitrary files on a server. According to GreyNoise, 110 unique IP addresses scanned Grafana instances in a single day, all marked as malicious, with attempts targeting the United States, Slovakia and Taiwan.

The activity on 28 September 2025 was dominated by Bangladesh-based sources, which accounted for 107 of the IPs, while China and Germany contributed two and one IPs respectively. The report notes that exploiting older high-impact flaws like CVE-2021-43798 is a common tactic, and advises organisations to block the 110 malicious IPs identified and ensure Grafana servers are patched against the vulnerability.

It also highlights that a coordinated pattern of traffic and tooling suggests a campaign rather than random scans, emphasising the importance of timely patching and vigilant monitoring.