Is CVE-2021-43798 (Grafana Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-43798 to its Known Exploited Vulnerabilities catalogue on 9 October 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Grafana contains a path traversal vulnerability that could allow access to local files. Any organisation running the affected product should treat remediation as urgent.

What the KEV listing means for Grafana path traversal exposure

CISA’s KEV inclusion is the practical signal that matters most here: it means defenders should assume the issue is being actively used against real targets, not just discussed as a theoretical flaw. For an internet-facing Grafana instance, that shifts the question from “is there a vulnerability?” to “is this service exposed, reachable, and already at risk?”

For teams that need a response playbook, the right starting point is a rapid exposure check, because path traversal issues often become dangerous when file paths, plugin content, or local configuration files are reachable through an HTTP request. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful here because it ties KEV triage to emergency mitigation, verification, and post-patch hunting.

Why path traversal changes the risk profile

Path traversal is not just a generic web flaw. In a monitoring and dashboarding product, it can become a file disclosure problem that exposes configuration material, environment details, or other local files that help an attacker move from initial access to deeper compromise. That is why a “read-only” issue can still create serious downstream security impact.

Attackers usually value these flaws because they often require little sophistication once the vulnerable path is known. A traversal bug can be chained with weak network exposure, predictable deployment layouts, or accessible admin interfaces to harvest data that should never leave the host. The broader attack pattern is well covered in NHIMG’s Web Application Attacks Guide, which helps place directory traversal in the wider family of file-read and injection-style abuses.

When organisations delay remediation, the main mistake is treating this as a low-severity disclosure issue because it is not remote code execution. In practice, any file read that reveals secrets, tokens, or environment information can become the first step in a much larger compromise.

How to verify exposure and respond if you cannot patch immediately

Start by confirming whether Grafana is deployed anywhere in your environment, then verify whether those instances are externally reachable, behind authentication, and covered by a configuration or asset owner. If the instance is internet-facing or poorly segmented, assume the exploitation window is already open and treat remediation as urgent rather than routine.

If patching must wait, reduce exposure immediately by restricting network access, removing unnecessary public reachability, tightening reverse-proxy rules, and monitoring for unusual requests against paths associated with traversal attempts. That buys time, but it does not replace the fix because the vulnerability class is about request handling, not just perimeter exposure.

For teams with broader vulnerability programs, NHIMG’s Vulnerability Management Guide helps connect KEV-backed prioritisation to exception handling, SLAs, and verification, so the issue is tracked as an operational risk instead of a one-off ticket.

Risk and Threat Considerations

A path traversal flaw in a widely deployed observability platform can expose more than a single file. If local configuration, secrets, or deployment details are reachable, the attacker may gain enough context to pivot into the monitoring environment, related infrastructure, or connected systems.

Failure mechanism: The application fails to constrain path handling tightly enough, allowing crafted requests to resolve local files that should remain outside the web root.

Impact: Exposure of local files can reveal credentials, tokens, configuration values, or system information that materially increases the chance of follow-on compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Network Monitoring	Active exploitation calls for monitoring exposed Grafana services and suspicious request patterns.
Recommendation — Monitor internet-facing Grafana instances for abnormal file-access and traversal request activity.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	A KEV-listed Grafana flaw needs prioritized identification and remediation under vulnerability management.
Recommendation — Prioritise and remediate KEV-listed Grafana exposure using a continuous vulnerability management process.
OWASP ASVS	V4 API and Web Service — API and Web Service	Path traversal is a web-service input handling weakness that can expose local files.
	V13 Configuration — Configuration	Exposure often depends on deployment and reverse-proxy configuration around the Grafana service.
Recommendation — Verify that web-service path handling blocks traversal and cannot reach local files. Harden deployment and proxy configuration to reduce reachable attack surface.
MITRE ATT&CK	T1005 — Data from Local System	Traversal-based file access maps to attacker collection of data from local files.
Recommendation — Hunt for collection of local files and configuration data from exposed hosts.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as a triage signal, not as a background vulnerability queue item. Prioritise every exposed Grafana instance by internet reachability, privilege of the host, and whether the service can access sensitive local material or adjacent systems.

What to verify: Confirm whether any vulnerable instance has evidence of unusual file-read requests, unexpected configuration access, or changes to dashboards, plugins, users, or tokens. If the service was exposed before remediation, validate whether credentials or local files could have been read and rotate anything that may have been accessible.

Practitioner takeaway: For KEV-listed path traversal, the key judgement is not whether exploitation is possible in theory, but whether the exposed service could have already leaked local data that changes your containment and rotation priorities.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org