PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-43798 Grafana Labs CVE debrief

CVE-2021-43798 is a Grafana path traversal vulnerability that CISA lists in the Known Exploited Vulnerabilities catalog. Because CISA has marked it as known exploited, Grafana deployments should be treated as urgent remediation candidates, especially where instances are reachable by many users or exposed to the internet.

Vendor
Grafana Labs
Product
Grafana
CVSS
HIGH 7.5
CISA KEV
Listed
Original CVE published
2025-10-09
Original CVE updated
2025-10-09
Advisory published
2025-10-09
Advisory updated
2025-10-09

Who should care

Grafana administrators, cloud and SaaS platform owners, security operations teams, and vulnerability management teams responsible for Grafana deployments.

Technical summary

The supplied sources identify this issue as a path traversal vulnerability in Grafana. CISA's KEV entry records it as known exploited and points to Grafana's advisory and the NVD/CVE records for additional reference. The corpus does not provide exploit mechanics beyond the path traversal classification.

Defensive priority

High. CISA added this CVE to KEV on 2025-10-09 and set a remediation due date of 2025-10-30, so affected systems should be prioritized immediately.

Recommended defensive actions

  • Apply the vendor's mitigations and follow the linked Grafana advisory guidance.
  • Upgrade to the fixed Grafana releases referenced in the KEV notes when they match your deployment branch (8.3.1, 8.2.7, 8.1.8, and 8.0.7).
  • If mitigations are unavailable, discontinue use of the product per CISA guidance.
  • For cloud services, follow applicable BOD 22-01 guidance.
  • Inventory Grafana instances and confirm remediation has been completed on every exposed deployment.

Evidence notes

This debrief is based on the supplied CISA KEV entry plus the official CVE.org and NVD links. The KEV metadata states Grafana Labs/Grafana, labels the issue as a path traversal vulnerability, marks it as known exploited, and references Grafana's 2021-12-07 advisory in the notes. The supplied corpus does not include a CVSS score or detailed exploit mechanics.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-43798 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-43798

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-43798 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-43798

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.