https://vulnogram.org/ Most recent CVEs assigned by Grafana Labs (grafana). https://vulnogram.org/seaview/icons/grafana.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-92539 https://vulnogram.org/CVE-2026-92539 A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enter… Medium Tue, 20 Oct 2026 16:55:17 GMT https://vulnogram.org/CVE-2026-9703 https://vulnogram.org/CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to th… High Thu, 15 Oct 2026 14:02:00 GMT https://vulnogram.org/CVE-2026-33374 https://vulnogram.org/CVE-2026-33374 The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions. Medium Tue, 13 Oct 2026 17:05:49 GMT https://vulnogram.org/CVE-2026-15577 https://vulnogram.org/CVE-2026-15577 A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the exper… Medium Tue, 13 Oct 2026 17:05:49 GMT https://vulnogram.org/CVE-2026-93294 https://vulnogram.org/CVE-2026-93294 A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role gran… Medium Tue, 13 Oct 2026 17:05:49 GMT https://vulnogram.org/CVE-2026-95502 https://vulnogram.org/CVE-2026-95502 A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured… Medium Tue, 13 Oct 2026 17:05:49 GMT https://vulnogram.org/CVE-2026-89039 https://vulnogram.org/CVE-2026-89039 A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials… Medium Mon, 05 Oct 2026 14:52:41 GMT https://vulnogram.org/CVE-2026-13720 https://vulnogram.org/CVE-2026-13720 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization chec… Medium Wed, 30 Sep 2026 11:06:38 GMT https://vulnogram.org/CVE-2026-13719 https://vulnogram.org/CVE-2026-13719 An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the o… Medium Wed, 30 Sep 2026 11:06:38 GMT https://vulnogram.org/CVE-2026-81842 https://vulnogram.org/CVE-2026-81842 An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check librar… Medium Tue, 29 Sep 2026 20:50:01 GMT https://vulnogram.org/CVE-2026-81841 https://vulnogram.org/CVE-2026-81841 Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dash… Medium Tue, 29 Sep 2026 20:35:57 GMT https://vulnogram.org/CVE-2026-15815 https://vulnogram.org/CVE-2026-15815 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an ex… High Thu, 17 Sep 2026 20:47:01 GMT https://vulnogram.org/CVE-2026-76154 https://vulnogram.org/CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org… High Thu, 17 Sep 2026 20:22:55 GMT https://vulnogram.org/CVE-2026-14199 https://vulnogram.org/CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so di… High Wed, 02 Sep 2026 16:06:28 GMT https://vulnogram.org/CVE-2026-12704 https://vulnogram.org/CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a… Medium Wed, 02 Sep 2026 16:05:42 GMT https://vulnogram.org/CVE-2026-19475 https://vulnogram.org/CVE-2026-19475 An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro c… Medium Wed, 02 Sep 2026 15:56:33 GMT https://vulnogram.org/CVE-2026-75889 https://vulnogram.org/CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its conten… High Thu, 27 Aug 2026 17:22:22 GMT https://vulnogram.org/CVE-2026-19854 https://vulnogram.org/CVE-2026-19854 When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop afte… Medium Thu, 27 Aug 2026 16:35:17 GMT https://vulnogram.org/CVE-2026-19197 https://vulnogram.org/CVE-2026-19197 A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control). Medium Wed, 26 Aug 2026 08:50:27 GMT https://vulnogram.org/CVE-2026-17033 https://vulnogram.org/CVE-2026-17033 An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's… Medium Mon, 24 Aug 2026 13:52:26 GMT https://vulnogram.org/CVE-2026-17183 https://vulnogram.org/CVE-2026-17183 An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expos… High Wed, 19 Aug 2026 17:30:06 GMT https://vulnogram.org/CVE-2026-11817 https://vulnogram.org/CVE-2026-11817 This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-contr… Medium Mon, 17 Aug 2026 21:28:17 GMT https://vulnogram.org/CVE-2026-19516 https://vulnogram.org/CVE-2026-19516 A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the… Critical Tue, 11 Aug 2026 05:28:30 GMT https://vulnogram.org/CVE-2026-9765 https://vulnogram.org/CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms i… High Fri, 24 Jul 2026 12:23:14 GMT https://vulnogram.org/CVE-2026-21723 https://vulnogram.org/CVE-2026-21723 The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint require… Medium Thu, 23 Jul 2026 01:48:16 GMT https://vulnogram.org/CVE-2026-21729 https://vulnogram.org/CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. High Thu, 16 Jul 2026 03:12:07 GMT https://vulnogram.org/CVE-2026-15583 https://vulnogram.org/CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against… High Wed, 15 Jul 2026 07:29:48 GMT https://vulnogram.org/CVE-2026-8595 https://vulnogram.org/CVE-2026-8595 A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting). Medium Fri, 10 Jul 2026 14:59:35 GMT https://vulnogram.org/CVE-2026-8609 https://vulnogram.org/CVE-2026-8609 An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). Medium Fri, 10 Jul 2026 14:58:33 GMT https://vulnogram.org/CVE-2026-33382 https://vulnogram.org/CVE-2026-33382 Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a… High Fri, 10 Jul 2026 14:58:23 GMT https://vulnogram.org/CVE-2026-28378 https://vulnogram.org/CVE-2026-28378 The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers. Low Tue, 07 Jul 2026 21:08:04 GMT https://vulnogram.org/CVE-2026-42127 https://vulnogram.org/CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through m… High Mon, 22 Jun 2026 16:31:28 GMT https://vulnogram.org/CVE-2026-28381 https://vulnogram.org/CVE-2026-28381 The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host. Critical Mon, 22 Jun 2026 13:20:29 GMT https://vulnogram.org/CVE-2026-9029 https://vulnogram.org/CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site s… High Mon, 22 Jun 2026 13:18:40 GMT https://vulnogram.org/CVE-2026-10601 https://vulnogram.org/CVE-2026-10601 A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses… Medium Mon, 22 Jun 2026 13:18:31 GMT https://vulnogram.org/CVE-2026-42129 https://vulnogram.org/CVE-2026-42129 A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information. High Mon, 22 Jun 2026 13:18:27 GMT https://vulnogram.org/CVE-2026-27878 https://vulnogram.org/CVE-2026-27878 A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service agai… Medium Fri, 19 Jun 2026 19:02:27 GMT https://vulnogram.org/CVE-2026-11769 https://vulnogram.org/CVE-2026-11769 We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards… Medium Sat, 13 Jun 2026 04:17:41 GMT https://vulnogram.org/CVE-2026-28374 https://vulnogram.org/CVE-2026-28374 Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. Medium Wed, 13 May 2026 19:28:40 GMT https://vulnogram.org/CVE-2026-33378 https://vulnogram.org/CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash th… Medium Wed, 13 May 2026 19:28:37 GMT https://vulnogram.org/CVE-2026-28383 https://vulnogram.org/CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of ser… Medium Wed, 13 May 2026 19:28:36 GMT https://vulnogram.org/CVE-2026-33376 https://vulnogram.org/CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Ok… High Wed, 13 May 2026 19:28:34 GMT https://vulnogram.org/CVE-2026-33380 https://vulnogram.org/CVE-2026-33380 A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Medium Wed, 13 May 2026 19:28:32 GMT https://vulnogram.org/CVE-2026-28380 https://vulnogram.org/CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Medium Wed, 13 May 2026 19:28:32 GMT https://vulnogram.org/CVE-2026-33381 https://vulnogram.org/CVE-2026-33381 When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. Medium Wed, 13 May 2026 19:28:31 GMT https://vulnogram.org/CVE-2026-33377 https://vulnogram.org/CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. High Wed, 13 May 2026 19:28:28 GMT https://vulnogram.org/CVE-2026-28376 https://vulnogram.org/CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger… Medium Wed, 13 May 2026 19:28:26 GMT https://vulnogram.org/CVE-2026-28379 https://vulnogram.org/CVE-2026-28379 A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafan… Medium Wed, 13 May 2026 19:28:25 GMT https://vulnogram.org/CVE-2026-21728 https://vulnogram.org/CVE-2026-21728 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18).… High Network Exploitable Fri, 24 Apr 2026 08:00:47 GMT https://vulnogram.org/CVE-2026-21726 https://vulnogram.org/CVE-2026-21726 The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan f… Medium Wed, 15 Apr 2026 19:24:31 GMT