CVE-2022-35957

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

• CWE-290
• CWE-290

• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9qVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
• https://security.netapp.com/advisory/ntap-20221215-0001/Third Party Advisory
• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9qVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
• https://security.netapp.com/advisory/ntap-20221215-0001/Third Party Advisory

Published

Sep 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35950OroCommerce is an open-source Business to Business Commerce …4.8
• CVE-2022-35951Redis is an in-memory database that persists on disk. Versio…9.8
• CVE-2022-35952TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35953BookWyrm is a social network for tracking your reading, talk…6.1
• CVE-2022-35954The GitHub Actions ToolKit provides a set of packages to mak…5
• CVE-2022-35956This Rails gem adds two methods to the ActiveRecord::Base cl…9.8
• CVE-2022-35958Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35959TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-3596An information leak was found in OpenStack's undercloud. Thi…7.5
• CVE-2022-35960TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35961OpenZeppelin Contracts is a library for secure smart contrac…6.5
• CVE-2022-35962Zulip is an open source team chat and Zulip Mobile is an app…5.7