GRAFANA

Latest CVEs · RSS

• CVE-2026-9703 2026-10-15 · CVSS 7.1
  Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an
• CVE-2026-33374 2026-10-13 · CVSS 6.5
  The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations tha
• CVE-2026-15577 2026-10-13 · CVSS 6.5
  A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (i
• CVE-2026-93294 2026-10-13 · CVSS 6.3
  A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the dat
• CVE-2026-95502 2026-10-13 · CVSS 5.3
  A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (unc
• CVE-2026-89039 2026-10-05 · CVSS 6.5
  A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of a
• CVE-2026-13720 2026-09-30 · CVSS 5.4
  An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard
• CVE-2026-13719 2026-09-30 · CVSS 4.3
  An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the
• CVE-2026-81842 2026-09-29 · CVSS 4.3
  An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library
• CVE-2026-81841 2026-09-29 · CVSS 5.3
  Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused sh
• CVE-2026-15815 2026-09-17 · CVSS 8.8
  Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic l
• CVE-2026-76154 2026-09-17 · CVSS 7.3
  A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in anot
• CVE-2026-14199 2026-09-02 · CVSS 7.1
  Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache
• CVE-2026-12704 2026-09-02 · CVSS 6.8
  When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-
• CVE-2026-19475 2026-09-02 · CVSS 6.5
  An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause,
• CVE-2026-75889 2026-08-27 · CVSS 7.7
  Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify
• CVE-2026-19854 2026-08-27 · CVSS 6.1
  When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to Cli
• CVE-2026-19197 2026-08-26 · CVSS 6.3
  A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover
• CVE-2026-17033 2026-08-24 · CVSS 6.8
  An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. T
• CVE-2026-17183 2026-08-19 · CVSS 7.1
  An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side ex
• CVE-2026-11817 2026-08-17 · CVSS 5.3
  This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization
• CVE-2026-19516 2026-08-11 · CVSS 9.1
  A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller als
• CVE-2026-9765 2026-07-24 · CVSS 7.1
  Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resource
• CVE-2026-21723 2026-07-23 · CVSS 5.3
  The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing te
• CVE-2026-21729 2026-07-16 · CVSS 7.5
  Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.