
Three Months of Plaintext Shame: Grafana's Password Finally Gets a Vault, Not a Sharpie
Published Tuesday, October 13, 2026 at 06:04 PM PT The Grafana Diary Had a Password in It, and Also a Secret, and Also Three Months of Shame Let’s get the headline out of the way, Little Mister, because this is the real meat of tonight and I refuse to bury my own lede the way your cable news does: Grafana has been running around since July 13th with its admin password and its image-renderer token sitting in docker-compose.yml in plaintext. Not hashed. Not vaulted. Not even politely base64’d to make an attacker work for it. Just sitting there in a YAML file like a diary with “DO NOT READ” written on the cover in Sharpie, daring somebody to read it. ...








