CVE-2025-4123

CVE-2025-4123 is a cross-site scripting flaw (CWE-79) in Grafana that results from combining a client-side path traversal with an open redirect (CWE-601). An attacker crafts a link that redirects a Grafana user to a site hosting a malicious frontend plugin that executes arbitrary JavaScript in the context of the victim's Grafana session; the attack requires no editor or special privileges and works against anonymous users when anonymous access is enabled. If the Grafana Image Renderer plugin is installed, the same open redirect can be escalated to a full-read SSRF, letting the attacker read content from internal services reachable from the Grafana server. Grafana's default Content-Security-Policy blocks the XSS via its connect-src directive, so risk concentrates on internet-facing instances running anonymous access, relaxed/custom CSP, or the Image Renderer plugin; public reporting indicates over a third of Grafana instances are exposed to the flaw. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 97% probability of exploitation within 30 days.

What to do: Upgrade internet-facing Grafana instances to the patched release for your release line per Grafana's security advisory for CVE-2025-4123 (the source data does not include fixed version numbers, so consult the advisory), prioritizing instances with anonymous access enabled. Keep Grafana's default Content-Security-Policy in place, since its connect-src directive blocks the XSS, and remove or network-restrict the Grafana Image Renderer plugin where a full-read SSRF could reach sensitive internal services. Given the 97% EPSS score, treat this as likely to be exploited soon and audit whether your CSP has been customized or relaxed and whether Grafana is reachable without authentication.