Every CVESearch/Get API key

CVE-2026-15815

CVE-2026-15815 CVE Record

8.8 HighFix available

CVE-2026-15815 is a high vulnerability (CVSS 8.8) in Grafana Enterprise, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in grafana 12.4.14-r0.

What does this mean?
Severity
8.8 HighCVSS 3.1, CVE List
Exploit chance
0.69%EPSS, 53rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
12.4.14-r0grafana +21 more

Description

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.69%Down 0.2 points since Sep 18, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grafana
Alpine:v3.24
before 12.4.14-r0
12.4.14-r0
grafana
AlmaLinux:8
before 9.2.10-35.el8_10
9.2.10-35.el8_10
grafana-selinux
AlmaLinux:8
before 9.2.10-35.el8_10
9.2.10-35.el8_10
grafana
Bitnami
11.6.0 up to 12.0.1, 12.1.0 up to 12.1.1, 12.2.0 up to 12.2.1, 12.3.0 up to 12.3.1, 12.4.0 up to 12.4.11, 13.0.0 up to 13.0.9, 13.1.0 up to 13.1.6, 13.2.0 up to 13.2.2
12.0.112.1.112.2.112.3.112.4.1113.0.913.1.613.2.2
grafana
Red Hat:enterprise_linux:8::appstream
before 0:9.2.10-35.el8_10
0:9.2.10-35.el8_10
grafana-debuginfo
Red Hat:enterprise_linux:8::appstream
before 0:9.2.10-35.el8_10
0:9.2.10-35.el8_10
grafana-debugsource
Red Hat:enterprise_linux:8::appstream
before 0:9.2.10-35.el8_10
0:9.2.10-35.el8_10
grafana-selinux
Red Hat:enterprise_linux:8::appstream
before 0:9.2.10-35.el8_10
0:9.2.10-35.el8_10
grafana
Red Hat:enterprise_linux:10.3
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana-debuginfo
Red Hat:enterprise_linux:10.3
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
Show 12 moreShow less
Affected packages
PackageAffectedFixed
grafana-debugsource
Red Hat:enterprise_linux:10.3
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana-selinux
Red Hat:enterprise_linux:10.3
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
before 0:10.2.6-24.el9_9.6
0:10.2.6-24.el9_9.6
grafana-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
before 0:10.2.6-24.el9_9.6
0:10.2.6-24.el9_9.6
grafana-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
before 0:10.2.6-24.el9_9.6
0:10.2.6-24.el9_9.6
grafana-selinux
Red Hat:enterprise_linux:9::appstream
From an advisory covering 16 CVEs
before 0:10.2.6-24.el9_9.6
0:10.2.6-24.el9_9.6
grafana
Rocky Linux:8
before 0:9.2.10-35.el8_10
0:9.2.10-35.el8_10
grafana-debugsource
Rocky Linux:10
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana-selinux
Rocky Linux:10
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana-debuginfo
Rocky Linux:10
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana
Rocky Linux:10
From an advisory covering 11 CVEs
before 0:12.4.3-3.el10_3.2
0:12.4.3-3.el10_3.2
grafana
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 12.4.11-1.1
12.4.11-1.1

What each source reports

CVE List Score used8.8

CVE-2026-15815 CVE Record

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
CVE-2026-15815
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-59, CWE-94, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-824728.8

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
EUVD-2026-82472
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xp8x-3q7w-cpqr8.8

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin...

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
GHSA-xp8x-3q7w-cpqr
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
NVD8.8

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
CVE-2026-15815
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-59, CWE-94
Updated
2026-11-02
OSVALPINE-CVE-2026-158158.8

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
ALPINE-CVE-2026-15815
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVRHSA-2026:835448.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:83544
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
Show 7 moreShow less
OSVRHSA-2026:980568.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:98056
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:984548.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:98454
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRLSA-2026:835448.8

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:83544
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:980568.8

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

  • grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

  • grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

  • grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

  • encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

  • encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

  • grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98056
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVALSA-2026:83544No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION (CVE-2026-15815)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:83544
Updated
2026-11-02
OSVBIT-grafana-2026-15815No score

CVE-2026-15815 CVE Record

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Record
BIT-grafana-2026-15815
Updated
2026-11-02
OSVopenSUSE-SU-2026:11920-1No score

grafana-12.4.11-1.1 on GA media

These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11920-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 122 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open