Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2025-6197

Medium

grafana: Open Redirect in Grafana

Published Jul 22, 2025 · Updated Oct 24, 2025 · Also known as BIT-grafana-2025-6197, UBUNTU-CVE-2025-6197

Key Facts

Patch immediately
  • CVE-2025-6197 is a medium-severity vulnerability (CVSS 4.2 v3.1) affecting grafana-11.4 (minimos), grafana-11.5 (minimos), grafana-11.6 (minimos) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 74% probability of exploitation in the next 30 days.
  • Fixed versions are available, including dracut-saltboot 1.0.0-150000.1.62.1, dracut-saltboot 1.0.0-150002.3.3.1, golang-github-prometheus-alertmanager 0.28.1-1.34.1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

4.2

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS (30-day exploit likelihood)

74%

Higher than 99.4% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2025-6197 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.

Prerequisites for exploitation:

- Multiple organizations must exist in the Grafana instance

- Victim must be on a different organization than the one specified in the URL

Affected Products

73 affected entries in total
ProductAffected versionsFixed in
grafana-11.4minimosSee advisory11.4.6-r0
grafana-11.5minimosSee advisory11.5.6-r0
grafana-11.6minimosSee advisory11.6.3-r0
grafana-12.0minimosSee advisory12.0.2-r0
Grafanabitnami>= 11.3.0, >= 12.0.x11.6.3
20 more affected products in the full CVE brief

Patched Releases

dracut-saltboot

1.0.0-150000.1.62.1, 1.0.0-150002.3.3.1

golang-github-prometheus-alertmanager

0.28.1-1.34.1, 0.28.1-120002.4.3.2, 0.28.1-150002.4.3.3

Grafana

11.5.10-1.87.1, 11.5.10-150000.1.87.1, 11.5.10-150200.3.80.1, 11.5.7-120002.4.3.2, 11.5.7-150002.4.3.3, 11.6.11-bp160.1.1, 11.6.3, 11.6.3+security01-1.1, 12.0.2, 11.3.8+security-01, 11.4.6+security-01, 11.5.6+security-01, 11.6.3+security-01, 12.0.2+security-01

grafana-11.4

11.4.6-r0

grafana-11.5

11.5.6-r0

grafana-11.6

11.6.3-r0

grafana-12.0

12.0.2-r0

mgr-push

5.0.3-1.30.3, 5.0.3-150000.1.30.1, 5.1.4-120002.3.3.3, 5.1.4-150002.3.3.3

mgrctl

0.1.37-1.27.1, 0.1.37-150000.1.27.1, 5.1.20-150002.3.3.3

mgrctl-bash-completion

0.1.37-1.27.1, 0.1.37-150000.1.27.1, 5.1.20-150002.3.3.3

mgrctl-lang

0.1.37-150000.1.27.1, 5.1.20-150002.3.3.3

mgrctl-zsh-completion

0.1.37-1.27.1, 0.1.37-150000.1.27.1, 5.1.20-150002.3.3.3

Multi-Linux-ManagerTools-SLE-release

12-120002.1.3.2

Multi-Linux-ManagerTools-SLE-release-POOL

12-120002.1.3.2

python-defusedxml

0.6.0-120002.1.3.1

python2-mgr-push

5.0.3-1.30.3, 5.1.4-120002.3.3.3

python2-rhnlib

5.0.6-21.55.1, 5.1.3-120002.3.3.1

python2-spacewalk-client-tools

5.1.7-120002.3.3.2

python3-defusedxml

0.7.1-150002.1.3.2

python3-mgr-push

5.0.3-150000.1.30.1, 5.1.4-150002.3.3.3

python3-rhnlib

5.0.6-150000.3.49.1, 5.1.3-150002.3.3.2

python3-spacewalk-client-tools

5.1.7-150002.3.3.3

spacecmd

5.0.14-150000.3.139.1, 5.0.14-38.162.1, 5.1.11-120002.3.3.2, 5.1.11-150002.3.3.2

spacewalk-client-tools

5.1.7-120002.3.3.2, 5.1.7-150002.3.3.3

supportutils-plugin-susemanager-client

5.0.5-150000.3.30.1, 5.0.5-6.36.1, 5.1.4-120002.3.3.1, 5.1.4-150002.3.3.2

Timeline

  1. Publicly disclosed

    Jul 22, 2025

  2. Last updated

    Oct 24, 2025

Weakness Type

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

References

FAQ

Common Questions.

Is CVE-2025-6197 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo