CVE-2025-41116

LowCVSS 2.1/10Last modified Oct 18, 2026

Description

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in

the wrong user identifier being used, and information for which the viewer is not authorized being returned.

This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

Metrics

CVSS 4.0 2.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-653

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-411176.1Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would r CVE-2025-411189.1Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object St CVE-2025-41129.8A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown cod CVE-2025-41138.8A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown CVE-2025-41149.8A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The mani CVE-2025-41159.8A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_vers CVE-2025-41169.8A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get CVE-2025-41179.8A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manip CVE-2025-41189.1A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the co CVE-2025-41197.5A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of t CVE-2025-41209.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manip CVE-2025-41219.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function c