A serious security flaw in Grafana monitoring platforms has left over 46,000 internet-facing systems vulnerable to account takeover attacks, despite patches being available for months.

## The Vulnerability Details

The security issue, designated CVE-2025-4123, affects multiple versions of Grafana, a popular open-source platform used for monitoring and visualizing infrastructure metrics. Bug bounty hunter Alvaro Balada discovered the vulnerability, which Grafana Labs patched on May 21. However, security researchers at OX Security found that more than one-third of publicly accessible Grafana instances remain unpatched.

## Scale of the Problem

OX Security’s analysis revealed alarming exposure statistics:
– **128,864 total Grafana instances** found online
– **46,506 systems still vulnerable** (approximately 36%)
– All vulnerable systems remain at risk of exploitation

The researchers dubbed this widespread exposure “The Grafana Ghost” due to its persistent presence across the internet.

## How the Attack Works

The vulnerability combines client-side path traversal with open redirect mechanics, allowing attackers to:

1. **Trick users** into clicking malicious URLs
2. **Load harmful plugins** from attacker-controlled servers
3. **Execute arbitrary JavaScript** in victims’ browsers
4. **Hijack user sessions** and change account credentials

The exploit is particularly dangerous because it:
– Requires no elevated privileges
– Works even with anonymous access enabled
– Can bypass browser security through Grafana’s JavaScript routing
– Enables account takeover via password reset manipulation

## Additional Risks

When the Grafana Image Renderer plugin is installed, attackers can also perform server-side request forgery (SSRF) attacks to access internal network resources.

## Exploitation Requirements

While the attack has some limitations, they don’t significantly reduce the threat:
– User must click a malicious link
– Victim needs an active session
– Plugin feature must be enabled (default setting)

The large number of exposed systems and lack of authentication requirements create a substantial attack surface.

## Immediate Action Required

Grafana administrators should immediately upgrade to these secure versions:
– 10.4.18+security-01
– 11.2.9+security-01
– 11.3.6+security-01
– 11.4.4+security-01
– 11.5.4+security-01
– 11.6.1+security-01
– 12.0.0+security-01

## Bottom Line

With nearly 50,000 systems remaining vulnerable months after patches became available, this represents a significant cybersecurity risk. Organizations using Grafana should prioritize immediate updates to prevent potential account takeovers and data breaches.