CVE-2026-27877

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312CWE-201

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-278786.5A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, rCVE-2026-278796.5A resample query can be used to trigger out-of-memory crashes in Grafana.CVE-2026-27889.8Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESCVE-2026-278807.5The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.CVE-2026-278815.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deCVE-2026-278824.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhCVE-2026-278835.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/vCVE-2026-278845.3NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file and folder path when CVE-2026-278857.2Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in PiwCVE-2026-278867.5Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently saniCVE-2026-278876.9Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to alCVE-2026-278887.5pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads
CVE-2026-27877: High severity, CVSS 7.5 | Vulnix