Grafana

What happened

The open-source data visualization tool Grafana has responded to a recent attack, stating that the attacker forked a Grafana repository, executed a curl command to inject malicious code, and exported environment variables into a file encrypted with a private key, thereby stealing access tokens. The attacker then deleted the fork to conceal their activity. Using the compromised credentials, the attacker replicated the attack against four private repositories. This unauthorized access was limited to automation systems and did not affect production environments or release artifacts. Based on the attack behavior, the goal appeared to be token theft and stealthy persistence for future use.

Details

Date

Apr 26, 2025

Kind

Hack or exploit

Method

Malicious Code Injection Attack

How in

Keys, accounts and infrastructure

Target

not stated

Chains

not stated

Reported by

• SlowMist Hacked ↗