CVE-2025-6197

CVE-2025-6197 is an open redirect (CWE-601) in the organization switching functionality of Grafana OSS. Exploitation requires two conditions: the Grafana instance must contain multiple organizations, and the victim must currently be on a different organization than the one specified in the attacker-crafted URL. The impact is limited — the CVSS vector scores low confidentiality and integrity impact with no availability impact — and is typical of open redirects that let attackers phish users or bounce them through a trusted Grafana domain. Only Grafana OSS deployments that use multiple organizations are affected; single-organization instances are not exploitable. No public proof of concept, in-the-wild exploitation, or CISA KEV listing is known yet, but the EPSS score of 70.1% (99th percentile) indicates an elevated likelihood of exploitation within the next 30 days.

What to do: Upgrade Grafana OSS to the patched release identified in Grafana's advisory for CVE-2025-6197, checking the advisory for the exact fixed version for your release branch. In the meantime, audit instances where multiple organizations are enabled (single-org deployments are not exploitable) and advise users to avoid clicking untrusted links that point to your Grafana domain. Given the elevated EPSS score of 70.1%, prioritize patching internet-facing Grafana instances.