# CVE-2026-81841: Paused shared dashboard access tokens still expose data source configuration

> CVE-2026-81841: Paused shared dashboard access tokens still expose data source configuration. CVSS 5.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-81841
Last updated: 2026-09-30T17:23:08Z

- Published: 2026-09-29 20:35 UTC · Updated: 2026-09-30 17:23 UTC · Assigner: GRAFANA
- CVSS: 5.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.38%, 32th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

## Affected vendors and products

- Grafana: Grafana Enterprise
- Grafana: Grafana OSS

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-81841)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81841)
- [https://grafana.com/security/security-advisories/cve-2026-81841](https://grafana.com/security/security-advisories/cve-2026-81841)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-81841 · Markdown: https://rewindex.com/cve/CVE-2026-81841.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-81841 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:57.438Z