CVEs.

Matching CVEs

1. 8.5High

   CVE-2026-33379 ↗ (opens in a new tab)

   A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

   GCGrafana Cloud· Nov 6, 2026

2. 7.7High

   CVE-2026-81938 ↗ (opens in a new tab)

   Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and conf

   GCGrafana Cloud· Nov 2, 2026

3. 7.7High

   CVE-2026-88967 ↗ (opens in a new tab)

   A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

   GCGrafana Cloud· Oct 28, 2026

4. 8.9High

   CVE-2026-103506 ↗ (opens in a new tab)

   An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

   GCGrafana Cloud· Oct 28, 2026

5. 7.7High

   CVE-2026-100105 ↗ (opens in a new tab)

   A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

   GCGrafana Cloud· Oct 28, 2026

6. 7.1High

   CVE-2026-9703 ↗ (opens in a new tab)

   Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana insta

   GCGrafana Cloud· Oct 15, 2026

7. 7.3High

   CVE-2026-76154 ↗ (opens in a new tab)

   A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

   GCGrafana Cloud· Sep 17, 2026

8. 8.8High

   CVE-2026-15815 ↗ (opens in a new tab)

   Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that

   GCGrafana Cloud· Sep 17, 2026

9. 8.1High

   CVE-2026-14199 ↗ (opens in a new tab)

   Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

   GCGrafana Cloud· Sep 2, 2026

10. 7.7High

    CVE-2026-75889 ↗ (opens in a new tab)

    Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.

    GCGrafana Cloud· Aug 27, 2026

11. 7.1High

    CVE-2026-17183 ↗ (opens in a new tab)

    An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

    GCGrafana Cloud· Aug 19, 2026

12. 7.1High

    CVE-2026-9765 ↗ (opens in a new tab)

    Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt

    GCGrafana Cloud· Jul 24, 2026

13. 7.5High

    CVE-2026-21729 ↗ (opens in a new tab)

    Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

    GCGrafana Cloud· Jul 16, 2026

14. 8.6High

    CVE-2026-15583 ↗ (opens in a new tab)

    A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

    GCGrafana Cloud· Jul 15, 2026

15. 7.5High

    CVE-2026-8609 ↗ (opens in a new tab)

    An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

    GCGrafana Cloud· Jul 10, 2026

16. 7.5High

    CVE-2026-33382 ↗ (opens in a new tab)

    Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

    GCGrafana Cloud· Jul 10, 2026

17. 7.5High

    CVE-2026-42127 ↗ (opens in a new tab)

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

    GCGrafana Cloud· Jun 22, 2026

18. 7.7High

    CVE-2026-42129 ↗ (opens in a new tab)

    A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

    GCGrafana Cloud· Jun 22, 2026

19. 8.1High

    CVE-2026-28381 ↗ (opens in a new tab)

    The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

    GCGrafana Cloud· Jun 22, 2026

20. 8.1High

    CVE-2026-33381 ↗ (opens in a new tab)

    When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

    GCGrafana Cloud· May 13, 2026

21. 7.1High

    CVE-2026-33377 ↗ (opens in a new tab)

    An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

    GCGrafana Cloud· May 13, 2026

22. 7.4High

    CVE-2026-33376 ↗ (opens in a new tab)

    When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

    GCGrafana Cloud· May 13, 2026

23. 7.5High

    CVE-2026-21728 ↗ (opens in a new tab)

    Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

    GCGrafana Cloud· Apr 24, 2026

24. 7.5High

    CVE-2026-27880 ↗ (opens in a new tab)

    The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

    GCGrafana Cloud· Mar 27, 2026

25. 7.5High

    CVE-2026-27877 ↗ (opens in a new tab)

    When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

    GCGrafana Cloud· Mar 27, 2026

26. 7.5High

    CVE-2026-28377 ↗ (opens in a new tab)

    A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

    GCGrafana Cloud· Mar 26, 2026

27. 8.1High

    CVE-2026-21721 ↗ (opens in a new tab)

    The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

    GCGrafana Cloud· Jan 27, 2026

28. 7.5High

    CVE-2026-21720 ↗ (opens in a new tab)

    Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

    GCGrafana Cloud· Jan 27, 2026

29. 7.6High

    CVE-2025-6023 ↗ (opens in a new tab)

    An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

    GCGrafana Cloud· Jul 18, 2025

30. 8.3High

    CVE-2025-3260 ↗ (opens in a new tab)

    A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboar

    GCGrafana Cloud· Jun 2, 2025