CVE-2025-41116
Low
Description
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
SeverityLow
CVSS2.1
Exploit probability—
ProductGrafana Databricks Datasource Plugin
PublishedNov 11, 2025
First seenNov 11, 2025
Weakness typeCWE-653CWE-653
How to fix
Update
- Grafana Labs Grafana Databricks Datasource Plugin1.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana Labs Grafana Databricks Datasource Plugin | 1.6.0 ≤ v < 1.12.1 | 1.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.