PT-2025-46532 · Grafana · Grafana Databricks Datasource Plugin

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-41116

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Grafana Databricks Datasource Plugin versions 1.12.1 through 1.12.0

Description The Grafana Databricks Datasource Plugin has an issue where, with Oauth passthrough enabled, multiple users sharing a single Grafana instance and datasource may experience incorrect user identification. This can lead to unauthorized information disclosure, as data intended for one user may be accessible to others.

Recommendations Update to a version after 1.12.0.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

BDU:2026-00241

CVE-2025-41116

Affected Products

Grafana Databricks Datasource Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41116 · Security Note
• https://bdu.fstec.ru/vul/2026-00241 · Security Note
• https://grafana.com/security/security-advisories/cve-2025-41116 · Note
• https://t.me/CVEtracker/37090 · Telegram Post
• https://twitter.com/CVEnew/status/1988348972201546030 · Twitter Post