CVE-2025-41116

LowCVSS 2.1/10Last modified Oct 18, 2026

Description

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result in 

the wrong user identifier being used, and information for which the viewer is not authorized being returned. 

This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

Metrics

CVSS 4.0 2.1/10CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-653

Affected software

VendorProductVersions
Grafana LabsGrafana Databricks Datasource Plugin>= 1.6.0, < 1.12.1

References

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-411176.1Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would rCVE-2025-411189.1Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object StCVE-2025-41129.8A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown codCVE-2025-41138.8A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown CVE-2025-41149.8A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The maniCVE-2025-41159.8A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_versCVE-2025-41169.8A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function getCVE-2025-41179.8A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipCVE-2025-41189.1A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the coCVE-2025-41197.5A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of tCVE-2025-41209.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipCVE-2025-41219.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function c
CVE-2025-41116: Low severity, CVSS 2.1 | Vulnix