# Grafana 5.4.5 and 6.3.4 Security Update

**URL:** <https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569>\
**Category:** Security Announcements\
**Created:** [August 29, 2019, 12:14pm UTC](https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569 "2019-08-29T12:14:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon34853223](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@anon34853223](https://community.grafana.com/u/anon34853223)\
**Post date:** [August 29, 2019, 12:14pm UTC](https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569/1 "2019-08-29T12:14:54Z")

</div>

We received a security report to [security@grafana.com](mailto:security@grafana.com) on August 12, 2019, about a vulnerability in Grafana involving incorrect access to the HTTP API. It was later identified as affecting Grafana versions from 2.0.0 to 6.3.3. CVE-2019-15043 has been reserved for this vulnerability.

This vulnerability allows a user/client to access parts of the Grafana HTTP API without being authenticated. This makes it possible to run a denial of service attack against the server running Grafana.

#### Affected versions

Grafana releases 2.0.0 through 6.3.3 are affected by this vulnerability.

#### Solutions and mitigations

Download and install the appropriate patch for your version of Grafana.

[Grafana Cloud](https://grafana.com/cloud) instances have already been patched, and [Grafana Enterprise](https://grafana.com/products/enterprise) customers have been provided with updated binaries.

### Conclusion

If you run a Grafana instance between version 2.0.0 and 6.3.3, please upgrade to Grafana [5.4.5](https://grafana.com/grafana/download/5.4.5) or [6.3.4](https://grafana.com/grafana/download/6.3.4) as soon as possible.