CVE-2018-15727
CriticalGrafana Authentication Bypass
Published Feb 15, 2022 · Updated Jul 8, 2026 · Also known as GHSA-rgjg-66cx-5x9m, GO-2022-0707, UBUNTU-CVE-2018-15727
Key Facts
Patch immediately- CVE-2018-15727 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Grafana, Ceph Storage (Redhat), github.com/grafana/grafana (go) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including ardana-ansible 8.0+git.1566374355.c509923-3.67.3, ardana-glance 8.0+git.1566376789.be0fe01-3.17.3, ardana-horizon 8.0+git.1565816064.5d4f73f-3.18.3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-15727 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Affected Products
529 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GrafanaGrafana | See advisory | 2.1.2 |
| Ceph StorageRedhat | 3.0 | n/a |
| github.com/grafana/grafanago | See advisory | 4.6.4 |
| tendrl-ansibleredhat | See advisory | 0:1.6.3-10.el7rhgs |
| tendrl-apiredhat | See advisory | 0:1.6.3-8.el7rhgs |
Patched Releases
ardana-ansible
8.0+git.1566374355.c509923-3.67.3
ardana-glance
8.0+git.1566376789.be0fe01-3.17.3
ardana-horizon
8.0+git.1565816064.5d4f73f-3.18.3
ardana-input-model
8.0+git.1566517401.98450e6-3.33.3
ardana-manila
8.0+git.1568835837.2452e7a-1.21.3
ardana-neutron
8.0+git.1568220097.74ee4b4-3.33.3
ardana-nova
8.0+git.1566902754.c58ff69-3.35.3
ardana-octavia
8.0+git.1568373448.bcaee7e-3.20.3
ardana-tempest
8.0+git.1566471887.fd2fec7-3.27.3
crowbar-core
4.0+git.1570463621.40b11cd48-9.54.1, 5.0+git.1569597589.1f025c557-3.32.2
crowbar-core-branding-upstream
4.0+git.1570463621.40b11cd48-9.54.1, 5.0+git.1569597589.1f025c557-3.32.2
crowbar-ha
5.0+git.1567673535.607aada-3.26.2
crowbar-openstack
4.0+git.1569429513.e7016b2b6-9.59.1, 5.0+git.1570141351.058c8bd44-4.31.2
crowbar-ui
1.2.0+git.1568396400.0344a727-3.12.3
galera-3
25.3.25-4.6.3
galera-3-wsrep-provider
25.3.25-4.6.3
github.com/grafana/grafana
4.6.4, 4.6.4+incompatible, 5.2.3, 5.2.3+incompatible
Grafana
0:4.6.4-1.el7rhgs, 4.6.5-1.11.2, 4.6.5-3.10.1, 4.6.5-4.6.3, <=2.1.2
libmariadb3
3.1.2-3.12.3
mariadb
10.2.25-4.14.2
mariadb-client
10.2.25-4.14.2
mariadb-connector-c
3.1.2-3.12.3
mariadb-errormessages
10.2.25-4.14.2
mariadb-galera
10.2.25-4.14.2
mariadb-tools
10.2.25-4.14.2
Timeline
Publicly disclosed
Feb 15, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-287 Improper Authentication
References
- advisoryhttps://bugzilla.suse.com/1019074
- advisoryhttps://bugzilla.suse.com/1052286
- advisoryhttps://bugzilla.suse.com/1096985
- advisoryhttps://bugzilla.suse.com/1106515
- advisoryhttps://bugzilla.suse.com/1108033
FAQ
Common Questions.
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Affected: Grafana; Ceph Storage (Redhat) versions 3.0; github.com/grafana/grafana (go), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ardana-ansible 8.0+git.1566374355.c509923-3.67.3, ardana-glance 8.0+git.1566376789.be0fe01-3.17.3, ardana-horizon 8.0+git.1565816064.5d4f73f-3.18.3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-15727 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo