Grafana vulnerabilities

Products

• Grafana 117
• Oss 45
• Enterprise 40
• Grafana/grafana 4
• Grafana/grafana-enterprise 4
• Loki 3
• Tempo 3
• Agent 2
• Alloy 2
• Enterprise Metrics 2
• Enterprise Traces (get) 2
• Enterprise 2
• Grafana-image-renderer 2
• Mcp Server 2
• Oncall 2
• Piechart-panel 2

Newest

• grafana enterprise, oss +1 more Dashboard snapshot permission bypass CVE-2026-33379 8.5 HighNovember 6, 2026
• grafana enterprise metrics (gem), mimir +1 more Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir CVE-2026-81938 7.7 HighNovember 2, 2026
• grafana enterprise, oss +1 more SSO settings authorization bypass CVE-2026-103506 8.9 HighOctober 28, 2026
• grafana oss, enterprise +1 more Server-side expression parser denial of service CVE-2026-88858 Fix available 6.5 MediumOctober 28, 2026
• grafana enterprise, oss +1 more Azure Monitor access token disclosure via SSRF CVE-2026-88967 Fix available 7.7 HighOctober 28, 2026
• grafana enterprise, oss +1 more Alerting contact point authorization bypass via schema downgrade CVE-2026-100105 Public exploitFix available 7.7 HighOctober 28, 2026
• grafana enterprise, oss +1 more CVE-2026-16491 CVE Record CVE-2026-16491 6.5 MediumOctober 27, 2026
• grafana enterprise Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise CVE-2026-92539 Fix available 6.7 MediumOctober 20, 2026
• grafana enterprise, oss +1 more Viewer role can create, modify and delete Loki alerting rules CVE-2026-9703 Fix available 7.1 HighOctober 15, 2026
• grafana enterprise, oss +1 more Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs CVE-2026-93294 Fix available 6.3 MediumOctober 13, 2026
• grafana enterprise, oss +1 more Unbounded memory allocation in the Prometheus rule conversion API CVE-2026-33374 Fix available 6.5 MediumOctober 13, 2026
• grafana enterprise, oss +1 more Git Sync connection configuration can be modified with read-only access CVE-2026-15577 Fix available 6.5 MediumOctober 13, 2026
• grafana enterprise, oss, nanogit +2 more Git Sync memory exhaustion via a malicious Git server CVE-2026-95502 5.3 MediumOctober 10, 2026
• grafana mcp-k6 Arbitrary file read via the convert_playwright_script prompt in mcp-k6 CVE-2026-89039 6.5 MediumOctober 5, 2026
• grafana enterprise, oss +1 more Editor can forge file-provisioning provenance on dashboards via the dashboard API CVE-2026-13720 Fix available 5.4 MediumSeptember 30, 2026
• grafana enterprise, oss +1 more Alert rules in restricted folders disclosed via the alert rules list API CVE-2026-13719 Fix available 4.3 MediumSeptember 30, 2026
• grafana enterprise, oss +1 more Library panel can be moved into a folder without library panel create permission CVE-2026-81842 Fix available 4.3 MediumSeptember 29, 2026
• grafana enterprise, oss +1 more Paused shared dashboard access tokens still expose data source configuration CVE-2026-81841 Fix available 5.3 MediumSeptember 29, 2026
• grafana enterprise, oss +1 more OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors CVE-2026-79656 Fix available 6.0 MediumSeptember 29, 2026
• grafana enterprise, oss +1 more CVE-2026-15815 CVE Record CVE-2026-15815 Fix available 8.8 HighSeptember 17, 2026
• grafana oss, enterprise +1 more CVE-2026-76154 CVE Record CVE-2026-76154 Fix available 7.3 HighSeptember 17, 2026
• grafana, grafana enterprise, oss +2 more Session takeover via Auth Proxy cache key collision CVE-2026-14199 Fix available 7.1 HighSeptember 2, 2026
• grafana enterprise SAML assertion replay via skipped InResponseTo validation CVE-2026-12704 Fix available 6.8 MediumSeptember 2, 2026
• grafana oss, microsoft sql server datasource, mysql datasource +1 more +3 more SQL Data Source Plugin: OOM DoS via $__timeGroup macro CVE-2026-19475 Fix available 6.5 MediumSeptember 2, 2026
• grafana alloy CVE-2026-75889 CVE Record CVE-2026-75889 Fix available 7.7 HighAugust 27, 2026
• grafana clickhouse datasource CVE-2026-19854 CVE Record CVE-2026-19854 6.1 MediumAugust 27, 2026
• grafana enterprise, oss +1 more Broken access control in dashboard snapshots CVE-2026-19197 Fix available 6.3 MediumAugust 26, 2026
• grafana oss CVE-2026-17033 CVE Record CVE-2026-17033 Fix available 6.8 MediumAugust 24, 2026
• grafana enterprise, oss +1 more CVE-2026-17183 CVE Record CVE-2026-17183 Fix available 7.1 HighAugust 19, 2026
• grafana oss, enterprise +1 more CVE-2026-11817 CVE Record CVE-2026-11817 Fix available 5.3 MediumAugust 17, 2026
• grafana mcp-grafana, mcp server +1 more CVE-2026-19516 CVE Record CVE-2026-19516 Public exploit 9.1 CriticalAugust 11, 2026
• grafana irm CVE-2026-9765 CVE Record CVE-2026-9765 7.1 HighJuly 24, 2026
• grafana oss CVE-2026-21723 Record CVE-2026-21723 Fix available 5.3 MediumJuly 23, 2026
• grafana oncall Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint CVE-2026-63087 9.3 CriticalJuly 16, 2026
• grafana loki Loki detected_fields query limits results in unbounded memory allocation CVE-2026-21729 7.5 HighJuly 16, 2026
• grafana mcp server SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header CVE-2026-15583 Public exploit 8.6 HighJuly 15, 2026
• grafana oss, grafana +1 more Stored XSS in the table panel (TableNG) CVE-2026-8595 Fix available 6.8 MediumJuly 10, 2026
• grafana, grafana oss +1 more Pre-authentication denial of service via the OAuth login route CVE-2026-8609 Fix available 5.3 MediumJuly 10, 2026
• grafana, grafana oss +1 more Denial of service via unbounded request body size CVE-2026-33382 Fix available 7.5 HighJuly 10, 2026
• grafana oss, grafana, grafana enterprise +2 more Cross-Organization Public Dashboard Deletion via Missing Org Isolation CVE-2026-28378 Fix available 3.1 LowJuly 7, 2026
• grafana, grafana enterprise, oss +2 more Pre-authentication denial of service in the public dashboard query endpoint CVE-2026-42127 Fix available 7.5 HighJune 22, 2026
• grafana snowflake, snowflake datasource +1 more Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT CVE-2026-28381 9.6 CriticalJune 22, 2026
• grafana oss, grafana +1 more Stored XSS in the Geomap panel tile-layer attribution CVE-2026-9029 Fix available 7.3 HighJune 22, 2026
• grafana, grafana oss +1 more Path traversal in the Tempo and Loki data source plugins CVE-2026-10601 Fix available 5.4 MediumJune 22, 2026
• grafana oss, loki datasource +1 more Path traversal in the Loki data source plugin CVE-2026-42129 Fix available 7.7 HighJune 22, 2026
• grafana tempo, enterprise traces (get) +1 more Tempo TraceQL query with exemplar hint could result in unbounded memory usage CVE-2026-27878 Fix available 6.5 MediumJune 19, 2026
• grafana operator Operator - Namespaced User Path Traversal CVE-2026-11769 Fix available 6.4 MediumJune 13, 2026
• grafana, grafana oss +1 more IDOR in Annotations API allows unprivileged users to DELETE annotation CVE-2026-28374 Fix available 4.3 MediumMay 13, 2026
• grafana, grafana oss +1 more Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro CVE-2026-33378 Fix available 6.5 MediumMay 13, 2026
• grafana, grafana oss +1 more Grafana plugin resources can lead to unbounded memory allocation CVE-2026-28383 Fix available 6.5 MediumMay 13, 2026
• Show olderLoading…