rules-grafana

Potentially unsafe pattern detected in grafana code: "allow_embedding = true". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

You are using an outdated API for grafana. Please upgrade to the newer API.

RISK: Loading unsigned Grafana plugins bypasses Grafana's plugin signing verification, allowing malicious plugins to access all datasources, dashboards, and Grafana's internal API with full server-side privileges. FIX: Only list specific internal plugins by ID in allow_loading_unsigned_plugins; never use a wildcard.

RISK: Enabling anonymous access (auth.anonymous enabled = true) exposes all dashboards and datasource metrics to unauthenticated users — this was the root cause of the Grafana CVE-2021-27358 snapshot disclosure. FIX: Set enabled = false under [auth.anonymous]; use Grafana organizations or embed signed URLs instead.

RISK: Hardcoding the Grafana database password in grafana.ini means any leaked config file hands attackers full read/write access to all dashboards, users, and alert rules. FIX: Use GF_DATABASE_PASSWORD env var or a secrets-management solution (Vault, AWS Secrets Manager).

RISK: Datasource provisioning files with plaintext passwords are often committed to Git and expose database/API credentials to anyone with repository access. FIX: Use secureJsonData fields with ${ENV_VAR} references so secrets are injected at runtime from the environment.

RISK: Disabling the login form or initial admin creation without a functioning SSO/LDAP fallback leaves Grafana with no administrative login path — or conversely, leaves it open with no auth at all. FIX: Only disable login_form after confirming OAuth/SAML/LDAP is fully operational and tested.

RISK: Enabling external snapshots (snapshots.external_enabled = true) allows anyone to publish dashboard snapshots to the public Grafana snapshot server, potentially leaking internal metric names, infrastructure topology, and business KPIs. FIX: Set external_enabled = false; use internal snapshots shared via org-gated links instead.

RISK: Using Grafana's default or empty secret_key means all datasource passwords are encrypted with a predictable key — any Grafana deployment with the same config shares the same encryption secret. FIX: Generate a unique secret_key (openssl rand -hex 32) per deployment and inject it via the GF_SECURITY_SECRET_KEY environment variable.

RISK: Committing an SMTP password in plaintext to grafana.ini exposes email account credentials to anyone with repository read access. FIX: Use environment variable expansion (password = $GF_SMTP_PASSWORD) or an external secret store injected at runtime.