Is there a public exploit for CVE-2021-39226?

Yes. CVE-2021-39226 is listed in the CISA Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild.

How severe is CVE-2021-39226?

CVE-2021-39226 scores CVSS 9.8 (v3.1), rated critical. EPSS puts the chance of exploitation in the next 30 days at 99.93%.

What does CVE-2021-39226 affect?

CVE-2021-39226 affects Grafana Labs Grafana.

9.8 Critical

Grafana is an open source data visualization platform.

CVE-2021-39226 Exploited

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "publicmode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "publicmode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side…

Being exploited in the wild

Catalogued 25 August 2022 · US federal remediation deadline 15 September 2022

Apply updates per vendor instructions.

Exploit code is also public: Nuclei template

NucleiGrafana Snapshot - Authentication Bypass

Assessment

CVSS: 9.8 (v3.1)
Severity: Critical
EPSS: 99.93% chance of exploitation in the next 30 days
Known exploited: Yes — listed in the CISA KEV catalog
Exploit availability: CISA KEV, Nuclei template
Published: 5 October 2021
Last updated: 17 June 2026
Affected: Grafana · Grafana Labs · Grafana
Weakness: CWE-287, CWE-862
Assigner: security-advisories@github.com

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

At the source

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Title *

Proof of concept *

Write-up (optional)

Affected versions (optional)

Name or handle (optional)

References (optional, one URL per line)

Licence for your contribution *

Private contact (optional, never shown)

Before you submit * This vulnerability is already publicly disclosed (it has a published CVE). This material comes only from testing I was authorised to perform. I have the legal right to publish this content and am not breaching any agreement by doing so. It contains no live credentials, personal data, or anything targeting systems I am not authorised to test. I understand it will be reviewed before it appears publicly and may be rejected. I agree to the submission terms.

What is 4 + 7? *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2021-39226