CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).

• CWE-200
• CWE-306

• https://github.com/grafana/grafana-image-renderer/pull/364Issue Tracking, Patch, Third Party Advisory
• https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5Mitigation, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221209-0004/Third Party Advisory
• https://github.com/grafana/grafana-image-renderer/pull/364Issue Tracking, Patch, Third Party Advisory
• https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5Mitigation, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221209-0004/Third Party Advisory

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31173Juniper is a GraphQL server library for Rust. Affected versi…7.5
• CVE-2022-31175CKEditor 5 is a JavaScript rich text editor. A cross-site sc…4.7
• CVE-2022-31177Flask-AppBuilder is an application development framework bui…2.7
• CVE-2022-31178eLabFTW is an electronic lab notebook manager for research t…4.3
• CVE-2022-31179Shescape is a simple shell escape package for JavaScript. Ve…9.8
• CVE-2022-3118A vulnerability was found in Sourcecodehero ERP System Proje…9.8
• CVE-2022-31180Shescape is a simple shell escape package for JavaScript. Af…9.8
• CVE-2022-31181PrestaShop is an Open Source e-commerce platform. In version…9.8