CVEs.

Matching CVEs

1. 6.0Med

   CVE-2026-79656 ↗ (opens in a new tab)

   A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.

   GCGrafana Cloud· Oct 28, 2026

2. 6.5Med

   CVE-2026-88858 ↗ (opens in a new tab)

   A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

   GCGrafana Cloud· Oct 28, 2026

3. 6.5Med

   CVE-2026-16491 ↗ (opens in a new tab)

   Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

   GCGrafana Cloud· Oct 27, 2026

4. 6.7Med

   CVE-2026-92539 ↗ (opens in a new tab)

   A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

   GCGrafana Cloud· Oct 20, 2026

5. 5.3Med

   CVE-2026-95502 ↗ (opens in a new tab)

   A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

   GCGrafana Cloud· Oct 13, 2026

6. 6.3Med

   CVE-2026-93294 ↗ (opens in a new tab)

   A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

   GCGrafana Cloud· Oct 13, 2026

7. 6.5Med

   CVE-2026-33374 ↗ (opens in a new tab)

   The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

   GCGrafana Cloud· Oct 13, 2026

8. 6.5Med

   CVE-2026-15577 ↗ (opens in a new tab)

   A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

   GCGrafana Cloud· Oct 13, 2026

9. 6.5Med

   CVE-2026-89039 ↗ (opens in a new tab)

   A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.

   GCGrafana Cloud· Oct 5, 2026

10. 5.4Med

    CVE-2026-13720 ↗ (opens in a new tab)

    An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

    GCGrafana Cloud· Sep 30, 2026

11. 4.3Med

    CVE-2026-13719 ↗ (opens in a new tab)

    An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

    GCGrafana Cloud· Sep 30, 2026

12. 4.3Med

    CVE-2026-81842 ↗ (opens in a new tab)

    An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

    GCGrafana Cloud· Sep 29, 2026

13. 5.3Med

    CVE-2026-81841 ↗ (opens in a new tab)

    Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

    GCGrafana Cloud· Sep 29, 2026

14. 6.5Med

    CVE-2026-19475 ↗ (opens in a new tab)

    An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

    GCGrafana Cloud· Sep 2, 2026

15. 6.8Med

    CVE-2026-12704 ↗ (opens in a new tab)

    When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

    GCGrafana Cloud· Sep 2, 2026

16. 6.1Med

    CVE-2026-19854 ↗ (opens in a new tab)

    When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

    GCGrafana Cloud· Aug 27, 2026

17. 6.3Med

    CVE-2026-19197 ↗ (opens in a new tab)

    A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

    GCGrafana Cloud· Aug 26, 2026

18. 6.8Med

    CVE-2026-17033 ↗ (opens in a new tab)

    An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-co

    GCGrafana Cloud· Aug 24, 2026

19. 5.3Med

    CVE-2026-11817 ↗ (opens in a new tab)

    This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secr

    GCGrafana Cloud· Aug 17, 2026

20. 5.3Med

    CVE-2026-21723 ↗ (opens in a new tab)

    The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

    GCGrafana Cloud· Jul 23, 2026

21. 5.4Med

    CVE-2026-8595 ↗ (opens in a new tab)

    A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

    GCGrafana Cloud· Jul 10, 2026

22. 5.4Med

    CVE-2026-9029 ↗ (opens in a new tab)

    A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

    GCGrafana Cloud· Jun 22, 2026

23. 4.3Med

    CVE-2026-10601 ↗ (opens in a new tab)

    A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

    GCGrafana Cloud· Jun 22, 2026

24. 6.5Med

    CVE-2026-27878 ↗ (opens in a new tab)

    A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

    GCGrafana Cloud· Jun 19, 2026

25. 6.4Med

    CVE-2026-11769 ↗ (opens in a new tab)

    We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affe

    GCGrafana Cloud· Jun 13, 2026

26. 6.5Med

    CVE-2026-33380 ↗ (opens in a new tab)

    A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

    GCGrafana Cloud· May 13, 2026

27. 6.5Med

    CVE-2026-33378 ↗ (opens in a new tab)

    Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

    GCGrafana Cloud· May 13, 2026

28. 6.5Med

    CVE-2026-28383 ↗ (opens in a new tab)

    A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

    GCGrafana Cloud· May 13, 2026

29. 6.5Med

    CVE-2026-28380 ↗ (opens in a new tab)

    Any Editor could delete any snapshot, even if they have no access to read or write them.

    GCGrafana Cloud· May 13, 2026

30. 6.5Med

    CVE-2026-28379 ↗ (opens in a new tab)

    A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

    GCGrafana Cloud· May 13, 2026

31. 6.5Med

    CVE-2026-28376 ↗ (opens in a new tab)

    The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

    GCGrafana Cloud· May 13, 2026

32. 4.3Med

    CVE-2026-28374 ↗ (opens in a new tab)

    Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

    GCGrafana Cloud· May 13, 2026

33. 5.3Med

    CVE-2026-21726 ↗ (opens in a new tab)

    The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.

    GCGrafana Cloud· Apr 15, 2026

34. 6.5Med

    CVE-2026-28375 ↗ (opens in a new tab)

    A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

    GCGrafana Cloud· Mar 27, 2026

35. 6.5Med

    CVE-2026-27879 ↗ (opens in a new tab)

    A resample query can be used to trigger out-of-memory crashes in Grafana.

    GCGrafana Cloud· Mar 27, 2026

36. 6.5Med

    CVE-2026-33375 ↗ (opens in a new tab)

    The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

    GCGrafana Cloud· Mar 26, 2026

37. 4.3Med

    CVE-2026-21724 ↗ (opens in a new tab)

    A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

    GCGrafana Cloud· Mar 26, 2026

38. 5.3Med

    CVE-2026-21722 ↗ (opens in a new tab)

    Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.

    GCGrafana Cloud· Feb 12, 2026

39. 6.1Med

    CVE-2025-41117 ↗ (opens in a new tab)

    Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

    GCGrafana Cloud· Feb 12, 2026

40. 4.3Med

    CVE-2025-10630 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.

    GCGrafana Cloud· Sep 19, 2025

41. 5.0Med

    CVE-2025-8341 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

    GCGrafana Cloud· Aug 4, 2025

42. 4.2Med

    CVE-2025-6197 ↗ (opens in a new tab)

    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

    GCGrafana Cloud· Jul 18, 2025

43. 4.3Med

    CVE-2025-3415 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

    GCGrafana Cloud· Jul 17, 2025

44. 5.0Med

    CVE-2025-3454 ↗ (opens in a new tab)

    This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

    GCGrafana Cloud· Jun 2, 2025

45. 5.5Med

    CVE-2025-3580 ↗ (opens in a new tab)

    An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instan

    GCGrafana Cloud· May 23, 2025

46. 6.1Med

    CVE-2025-4123 ↗ (opens in a new tab)

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

    GCGrafana Cloud· May 22, 2025

47. 6.8Med

    CVE-2025-2703 ↗ (opens in a new tab)

    The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

    GCGrafana Cloud· Apr 23, 2025

48. 4.3Med

    CVE-2024-11741 ↗ (opens in a new tab)

    Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

    GCGrafana Cloud· Jan 31, 2025

49. 5.1Med

    CVE-2024-9476 ↗ (opens in a new tab)

    A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

    GCGrafana Cloud· Nov 13, 2024