Instance config inline secret exposure in Grafana
Published Dec 8, 2021 · Updated Nov 3, 2026
Original summary
Normalized public record · Updated Nov 3, 2026
Instance config inline secret exposure in Grafana
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:
Potential impact
Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config Inline secrets for integrations are exposed at /-/config Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config. Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config. Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}. Inline secrets will be exposed to anyone being able to reach these endpoints. Secrets found in these sections are used for: Delivering metrics to a Prometheus Remote Write system Authenticating against a system for discovering Prometheus targets Authenticating against a system for collecting metrics (scrapeconfigs and integrations) Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode Authenticating against Kafka for receiving traces Non-inlined secrets, such as file-based secrets, are not impacted by this vulnerability.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- Source repository ↗
- Patch commit ↗
- Source repository ↗
- Source repository ↗
- security.netapp.com ↗
Record history
Published Dec 8, 2021 · Last refreshed Nov 3, 2026