CVEs.

Matching CVEs

1. 7.4High

   CVE-2026-33376 ↗ (opens in a new tab)

   When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

   GCGrafana Cloud· May 13, 2026

2. 6.5Med

   CVE-2026-28383 ↗ (opens in a new tab)

   A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

   GCGrafana Cloud· May 13, 2026

3. 6.5Med

   CVE-2026-28380 ↗ (opens in a new tab)

   Any Editor could delete any snapshot, even if they have no access to read or write them.

   GCGrafana Cloud· May 13, 2026

4. 6.5Med

   CVE-2026-28379 ↗ (opens in a new tab)

   A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

   GCGrafana Cloud· May 13, 2026

5. 6.5Med

   CVE-2026-28376 ↗ (opens in a new tab)

   The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

   GCGrafana Cloud· May 13, 2026

6. 4.3Med

   CVE-2026-28374 ↗ (opens in a new tab)

   Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

   GCGrafana Cloud· May 13, 2026

7. 7.5High

   CVE-2026-21728 ↗ (opens in a new tab)

   Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

   GCGrafana Cloud· Apr 24, 2026

8. 3.3Low

   CVE-2026-21727 ↗ (opens in a new tab)

   A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

   GCGrafana Cloud· Apr 15, 2026

9. 5.3Med

   CVE-2026-21726 ↗ (opens in a new tab)

   The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

   GCGrafana Cloud· Apr 15, 2026

10. 9.1Crit

    CVE-2025-41118 ↗ (opens in a new tab)

    Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.

    GCGrafana Cloud· Apr 15, 2026

11. 1.3Low

    CVE-2025-12141 ↗ (opens in a new tab)

    In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and pote

    GCGrafana Cloud· Apr 15, 2026

12. 6.5Med

    CVE-2026-28375 ↗ (opens in a new tab)

    A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

    GCGrafana Cloud· Mar 27, 2026

13. 7.5High

    CVE-2026-27880 ↗ (opens in a new tab)

    The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

    GCGrafana Cloud· Mar 27, 2026

14. 6.5Med

    CVE-2026-27879 ↗ (opens in a new tab)

    A resample query can be used to trigger out-of-memory crashes in Grafana.

    GCGrafana Cloud· Mar 27, 2026

15. 7.5High

    CVE-2026-27877 ↗ (opens in a new tab)

    When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

    GCGrafana Cloud· Mar 27, 2026

16. 9.1Crit

    CVE-2026-27876 ↗ (opens in a new tab)

    A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an up

    GCGrafana Cloud· Mar 27, 2026

17. 7.5High

    CVE-2026-28377 ↗ (opens in a new tab)

    A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

    GCGrafana Cloud· Mar 26, 2026

18. 6.5Med

    CVE-2026-33375 ↗ (opens in a new tab)

    The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

    GCGrafana Cloud· Mar 26, 2026

19. 4.3Med

    CVE-2026-21724 ↗ (opens in a new tab)

    A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

    GCGrafana Cloud· Mar 26, 2026

20. 2.0Low

    CVE-2026-21725 ↗ (opens in a new tab)

    A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as t

    GCGrafana Cloud· Feb 25, 2026

21. 5.3Med

    CVE-2026-21722 ↗ (opens in a new tab)

    Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.

    GCGrafana Cloud· Feb 12, 2026

22. 6.1Med

    CVE-2025-41117 ↗ (opens in a new tab)

    Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

    GCGrafana Cloud· Feb 12, 2026

23. 8.1High

    CVE-2026-21721 ↗ (opens in a new tab)

    The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

    GCGrafana Cloud· Jan 27, 2026

24. 7.5High

    CVE-2026-21720 ↗ (opens in a new tab)

    Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

    GCGrafana Cloud· Jan 27, 2026

25. 9.8Crit

    CVE-2025-41115 ↗ (opens in a new tab)

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enable

    GCGrafana Cloud· Nov 21, 2025

26. 2.1Low

    CVE-2025-41116 ↗ (opens in a new tab)

    When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0

    GCGrafana Cloud· Nov 11, 2025

27. 2.1Low

    CVE-2025-3717 ↗ (opens in a new tab)

    When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.

    GCGrafana Cloud· Nov 11, 2025

28. 9.9Crit

    CVE-2025-11539 ↗ (opens in a new tab)

    Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.

    GCGrafana Cloud· Oct 9, 2025

29. 4.3Med

    CVE-2025-10630 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.

    GCGrafana Cloud· Sep 19, 2025

30. 5.0Med

    CVE-2025-8341 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

    GCGrafana Cloud· Aug 4, 2025

31. 4.2Med

    CVE-2025-6197 ↗ (opens in a new tab)

    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

    GCGrafana Cloud· Jul 18, 2025

32. 7.6High

    CVE-2025-6023 ↗ (opens in a new tab)

    An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

    GCGrafana Cloud· Jul 18, 2025

33. 4.3Med

    CVE-2025-3415 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

    GCGrafana Cloud· Jul 17, 2025

34. 2.7Low

    CVE-2025-1088 ↗ (opens in a new tab)

    In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

    GCGrafana Cloud· Jun 18, 2025

35. 5.0Med

    CVE-2025-3454 ↗ (opens in a new tab)

    This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

    GCGrafana Cloud· Jun 2, 2025

36. 8.3High

    CVE-2025-3260 ↗ (opens in a new tab)

    A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboar

    GCGrafana Cloud· Jun 2, 2025

37. 5.5Med

    CVE-2025-3580 ↗ (opens in a new tab)

    An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instan

    GCGrafana Cloud· May 23, 2025

38. 6.1Med

    CVE-2025-4123 ↗ (opens in a new tab)

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

    GCGrafana Cloud· May 22, 2025

39. 6.8Med

    CVE-2025-2703 ↗ (opens in a new tab)

    The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

    GCGrafana Cloud· Apr 23, 2025

40. 4.3Med

    CVE-2024-11741 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

    GCGrafana Cloud· Jan 31, 2025

41. 5.1Med

    CVE-2024-9476 ↗ (opens in a new tab)

    A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

    GCGrafana Cloud· Nov 13, 2024