grafana vulnerabilities (Bitnami)
123 vulnerabilities.
-
grafanaBitnami Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise 6.7 Medium -
grafanaBitnami Viewer role can create, modify and delete Loki alerting rules 7.1 High -
grafanaBitnami Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs 6.3 Medium -
grafanaBitnami Unbounded memory allocation in the Prometheus rule conversion API 6.5 Medium -
grafanaBitnami Git Sync connection configuration can be modified with read-only access 6.5 Medium -
grafanaBitnami Editor can forge file-provisioning provenance on dashboards via the dashboard API 5.4 Medium -
grafanaBitnami Alert rules in restricted folders disclosed via the alert rules list API 4.3 Medium -
grafanaBitnami Library panel can be moved into a folder without library panel create permission 4.3 Medium -
grafanaBitnami Paused shared dashboard access tokens still expose data source configuration 5.3 Medium -
grafanaBitnami CVE-2026-15815 CVE Record 8.8 High -
grafanaBitnami CVE-2026-76154 CVE Record 7.3 High -
grafanaBitnami Session takeover via Auth Proxy cache key collision 7.1 High -
grafanaBitnami SAML assertion replay via skipped InResponseTo validation 6.8 Medium -
grafanaBitnami SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
grafanaBitnami Broken access control in dashboard snapshots 6.3 Medium -
grafanaBitnami CVE-2026-17033 CVE Record 6.8 Medium -
grafanaBitnami CVE-2026-17183 CVE Record 7.1 High -
grafanaBitnami CVE-2026-11817 CVE Record 5.3 Medium -
grafanaBitnami CVE-2026-21723 Record 5.3 Medium -
grafanaBitnami Stored XSS in the table panel (TableNG) 6.8 Medium -
grafanaBitnami Pre-authentication denial of service via the OAuth login route 5.3 Medium -
grafanaBitnami Denial of service via unbounded request body size 7.5 High -
grafanaBitnami Cross-Organization Public Dashboard Deletion via Missing Org Isolation 3.1 Low -
grafanaBitnami Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
grafanaBitnami Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
grafanaBitnami Path traversal in the Tempo and Loki data source plugins 5.4 Medium -
grafanaBitnami IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
grafanaBitnami Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
grafanaBitnami Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
grafanaBitnami Auth Proxy IPv6 whitelist bypass 7.4 High -
grafanaBitnami SQL Expressions Read File From Disk 6.3 Medium -
grafanaBitnami BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
grafanaBitnami Users can generate Service Account tokens after permissions removal 5.9 Medium -
grafanaBitnami Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
grafanaBitnami Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium -
grafanaBitnami Viewer-triggered race condition in Grafana Live leads to complete server crash 6.5 Medium -
grafanaBitnami Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record 3.3 Low -
grafanaBitnami Grafana Alerting Editors can edit destination of webhooks they did not create 1.3 Low -
grafanaBitnami Query resampling can cause unbounded memory allocations 6.5 Medium -
grafanaBitnami Grafana Testdata datasource can issue unbounded memory allocations 6.5 Medium -
grafanaBitnami RCE on Grafana via sqlExpressions 9.1 Critical -
grafanaBitnami OpenFeature evaluation API reads input data with no bounds 7.5 High -
grafanaBitnami Public dashboards discloses all direct mode datasources 6.5 Medium -
grafanaBitnami Missing Protected-field Authorization in Provisioning Contact Points API 5.4 Medium -
grafanaBitnami Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS 6.5 Medium -
grafanaBitnami Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name 2.6 Low -
grafanaBitnami XSS in Grafana Explore stack trace 6.8 Medium -
grafanaBitnami Public Dashboards time range restriction on annotations can be bypassed 5.3 Medium -
grafanaBitnami Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation 8.1 High -
grafanaBitnami Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out 7.5 High - Show olderLoading…