VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 07:44 UTC

CVE-2021-43798

Read full description

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.3/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.5: +1.12
Fresh EPSS: 88.50%: +0.44

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

5/100

Grounded branding (15%)

0/100

HYPE TOTAL3/100

Sources and documents

Recorded Future

Press · 13 Oct 2026, 07:00 · 2026年9月 CVEの概況 - Recorded Future

Recorded Future

Press · 13 Sep 2026, 07:00 · September 2026 CVE Landscape - Recorded Future

Recorded Future

Press · 06 Nov 2025, 08:00 · October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention - Recorded Future

Field Effect

Press · 07 Oct 2025, 07:00 · Legacy vulnerabilities remain prime targets of exploitation - Field Effect

BleepingComputer

Press · 04 Oct 2025, 07:00 · Massive surge in scans targeting Palo Alto Networks login portals - BleepingComputer

See all 10 source documents

GreyNoise

Press · 02 Oct 2025, 07:00 · Coordinated Grafana Exploitation Attempts on 28 September - GreyNoise

GreyNoise

Press · 28 Jan 2022, 08:00 · Malicious Tag Roundup (January 2022) | Cybersecurity Blog - GreyNoise

CloudSEK

Press · 09 Dec 2021, 08:00 · Grafana CVE-2021-43798 Vulnerability Actively Exploited in the Wild - CloudSEK

BleepingComputer

Press · 07 Dec 2021, 08:00 · Grafana fixes zero-day vulnerability after exploits spread over Twitter - BleepingComputer

The Record from Recorded Future News

Press · 06 Dec 2021, 08:00 · Grafana releases security patch after exploit for severe bug goes public - The Record from Recorded Future News

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.3 · reality 8.6 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 8 repos with metrics

Repository	Stars	Forks	Language	Updated
CLincat/vulcat	133	17	Python	14 Apr 2026, 14:44
MoCh3n/CVE-2021-43798-grafana_fileread	17	1	Python	27 Jan 2022, 08:35
ScorpionsMAX/CVE-2021-43798-Grafana-POC	14	4	Python	17 Dec 2021, 02:57
Mo0ns/Grafana_POC-CVE-2021-43798	9	1	Python	09 Dec 2021, 09:56
str1keboo/CVE-2021-43798	1	0	Python	01 Nov 2026, 18:56
notbside/CVE-2021-43798-PoC	0	0	—	27 Jan 2026, 16:50
rnsss/CVE-2021-43798-poc	0	3	Python	07 Jan 2022, 03:09
Squ1shification/Grafana-Plugin-Enumerator-CVE-2021-43798	0	0	Shell	18 Sep 2026, 03:59

Public exploit evidence

exploitdb #50581 2021-12-09

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.5; EPSS 88.5%
Attention, last 30 days: 1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:32.072469+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

06 Dec 2021, 08:00

Published

07 Dec 2021, 18:25

Added to the CISA KEV catalog

09 Oct 2025, 00:00

Latest press mention

13 Oct 2026, 07:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

8 repositories