U.S. CISA adds Grafana flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Grafana flaw to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2021-43798 with a CVSS score of 7.5. The vulnerability is a directory traversal issue affecting Grafana versions 8.0.0-beta1 through 8.3.0 (except patched releases), allowing an attacker to read local files by manipulating the plugin path in the URL.

Self-hosted Grafana installations must update to versions 8.0.7, 8.1.8, 8.2.7 or 8.3.1 to fix the flaw, while Grafana Cloud was not affected. CISA orders federal agencies to fix the vulnerabilities by October 30, 2025, in line with the due date under Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, and experts advise private organisations to review the KEV catalog and address the vulnerabilities in their infrastructure.

Grafana is an open-source platform for monitoring and observability, and the advisory emphasises mitigating the risk posed by this exposure across federal networks.