CVE-2022-26148
Redhat Ceph Storage 3.0 … 5.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-26148 is a critical-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Redhat Ceph Storage. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-26148 affects Grafana versions through 7.3.4 when integrated with Zabbix. The vulnerability stems from exposure of the Zabbix account password and URL address directly in the api_jsonrpc.php HTML source code, classified under CWE-312 as cleartext storage of sensitive information.
An unauthenticated remote attacker can exploit the flaw by logging in or registering a user account, then inspecting the page source and searching for the password string. Successful exploitation grants access to the Zabbix credentials, enabling full compromise of the linked Zabbix instance and any connected data or systems, consistent with the CVSS 9.8 rating reflecting network-accessible attack with no required privileges or user interaction.
Public references include NetApp security advisories and technical write-ups at 2k8.org that document the exposure and recommend reviewing integration configurations.
The CVE carries a high exploitation probability with an EPSS score currently at 0.8722 and a peak of 0.9032.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30715
Vulnerability Data
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to…
more
view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents cleartext storage of the Zabbix password that is rendered into api_jsonrpc.php HTML source.
Requires secure authenticator handling so credentials are never embedded in client-visible HTML responses.
Ensures confidentiality protections during transmission so the password cannot be observed in rendered page source.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring non-standard deletion or physical destruction of media ensures that sensitive information is not left in cleartext on discarded or repurposed equipment.
Secure deletion of data before device transfer prevents residual sensitive information from remaining in cleartext on storage media that leave organizational control.
Secure deletion of obsolete or temporary copies prevents sensitive data from remaining in cleartext on disk after its intended lifetime.
Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.
When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.
By insisting that any retained test copies be stored securely and only for testing, the control reduces the likelihood that clear-text operational data will persist on disk or in backups.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. via CWE-312