CVE-2025-6023

An open redirect vulnerability in Grafana OSS can be chained with path traversal issues to achieve cross-site scripting (XSS) attacks against Grafana users. The flaw was introduced in Grafana v11.5.0 per the advisory, and it is triggered when an attacker induces an unauthenticated user (user interaction required per the CVSS vector) to follow a crafted URL that redirects through a vulnerable Grafana instance. By chaining the open redirect with path traversal, an attacker can execute script in the victim's browser context, with potential theft of session tokens or in-browser actions, reflected in the high confidentiality and low integrity/availability impact of the 7.6 CVSS score. Anyone running affected Grafana OSS versions is exposed, with internet-facing instances at greatest risk. As of now there is no public proof of concept and no confirmed in-the-wild exploitation, although EPSS assigns a high 42.1% probability of exploitation within 30 days.

What to do: Upgrade Grafana OSS to the patched security release for your branch: 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01, or 11.3.8+security-01. Until patched, restrict internet exposure of Grafana instances and caution users against clicking unsolicited links pointing to your Grafana domain. Review web/proxy logs for crafted redirect URLs that may indicate exploitation attempts, given the elevated EPSS score.