# CVE-2026-21722: Public Dashboards time range restriction on annotations can be bypassed

> CVE-2026-21722: Public Dashboards time range restriction on annotations can be bypassed. CVSS 5.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-21722
Last updated: 2026-08-27T17:22:42Z

- Published: 2026-02-12 08:49 UTC · Updated: 2026-08-27 17:22 UTC · Assigner: GRAFANA
- CVSS: 5.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.36%, 30th percentile (scored 2026-10-25)
- CISA KEV: no

## Description

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.

## Affected vendors and products

- Grafana: grafana/grafana
- Grafana: grafana/grafana-enterprise

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-21722)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-21722)
- [https://grafana.com/security/security-advisories/cve-2026-21722](https://grafana.com/security/security-advisories/cve-2026-21722)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-21722 · Markdown: https://rewindex.com/cve/CVE-2026-21722.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-21722 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:04:13.247Z