# Grafana

> Grafana is an analytics dashboard platform. Attackers enumerate versions, exploit CVEs for RCE or auth bypass, steal credentials from data sources, and pivot via backend integrations

- **URL:** https://hackindex.io/services/grafana
- **Type:** Service
- **Default ports:** 3000
- **Tags:** grafana, web, dashboard, metrics, http, monitoring
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

Grafana is an open-source analytics and monitoring platform used for visualizing metrics from data sources like Prometheus, Elasticsearch, InfluxDB, and databases. It typically runs on **TCP port 3000**. Nmap identifies it as `http` on this port, with Grafana identifiable through response headers and the login page.

Grafana instances are attractive targets because they aggregate data from multiple backend systems and store data source credentials. Default credentials (`admin:admin`) are a frequent finding. Known path traversal vulnerabilities (such as CVE-2021-43798) have allowed unauthenticated arbitrary file reads on the server. Grafana's data source proxy feature can be leveraged to access backend databases and APIs that are otherwise not directly reachable, turning Grafana into an SSRF pivot point.

Enumeration begins with checking for the default login, then testing known credentials and attempting user registration if self-signup is enabled. The `/api/datasources` endpoint (when authenticated) reveals all configured data sources with connection details. Exploring dashboard configurations can expose sensitive queries, internal hostnames, and infrastructure topology. Checking the Grafana version against known CVEs and testing the data source proxy for SSRF opportunities are standard assessment steps.

## Phases

- [Enumeration](https://hackindex.io/services/grafana/enumeration.md): Enumerate Grafana via health API, default creds, dashboards, datasources (1 guides)
- [Exploitation](https://hackindex.io/services/grafana/exploitation.md): Read files unauthenticated via path traversal CVE-2021-43798 (1 guides)