-
What Grafana version and what operating system are you using? Grafana v12.3.6 running on K8s. Pod running Alpine Linux v3.23.
-
What are you trying to achieve? Security test found snapshots can be deleted by any authenticated user. We need to better control the permissions of who can delete existing snapshots.
-
How are you trying to achieve it? We need to make snapshot deletion more secure or just disable the feature/function.
-
What happened? Any signed-in user that acquires the delete key can delete the snapshot without snapshot-delete permission. On deletion, it lacked permission checks allowing low-level user to execute and delete the snapshot.
-
What did you expect to happen? Some permission check to avoid any authenticated used to delete snapshots.
-
Can you copy/paste the configuration(s) that you are having problems with? N/A
-
Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were. No error, the deletion was performed successfully.
-
Did you follow any online instructions? If so, what is the URL? No.
In this issue on Grafana 12 on Alpine Linux (Docker)
A viewer user can delete any snapshot just by knowing the delete key - no permission check
so for increasing safety purpose we need to disable snapshots in grafana.ini
[snapshots]
enabled = false
For K8s deployment add as environment variable
env
name GF_SNAPSHOTS_ENABLED
value “false”
now the user is blocked which means now any user cannot delete snapshot
