Skip to contentGrafana Enterprise vulnerabilities
- grafana elasticsearch datasource, enterprise, oss +2 moreMemory exhaustion denial of service in Elasticsearch data source index patternsCVE-2026-818436.5 Medium
- grafana (built-in) google cloud monitoring datasource, enterprise, oss +2 moreUnintended API access through the Google Cloud Monitoring data source resource proxyCVE-2026-1073655.3 Medium
- grafana elasticsearch datasource, enterprise, oss +2 moreElasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentialsCVE-2026-1064757.1 High
- grafana enterprise, oss, prometheus datasource +2 moreServer-side request forgery in the Prometheus data source resource APICVE-2026-1064726.3 Medium
- grafana enterprise, oss +1 moreGit Sync connections send credentials to unvalidated server URLsCVE-2026-1102895.5 Medium
- grafana oss, enterprise +1 moreCross-instance user impersonation through image renderer JWTsCVE-2026-1025897.1 High
- grafana enterprise, oss +1 moreFolder permission bypass in the Git Sync repository files APICVE-2026-1110247.1 High
- grafana enterprise, oss +1 morePrivilege escalation through folder move in the folders APICVE-2026-1110007.1 High
- grafana enterprise, oss +1 moreMemory exhaustion denial of service in SQL ExpressionsCVE-2026-1075096.5 Medium
- grafana enterprise, oss +1 morePath traversal in Git Sync delete and move jobsCVE-2026-1109926.5 Medium
- grafana enterprise, oss +1 moreTeam preferences RBAC bypass through the set-home-dash endpointCVE-2026-820144.3 Medium
- grafana enterprise, oss +1 moreAuthorization bypass in the Git Sync provisioning jobs APICVE-2026-142426.5 Medium
- grafana enterprise, oss +1 moreFolder authorization bypass in the Git Sync provisioning files APICVE-2026-137216.5 Medium
- grafana enterprise, oss +1 moreDashboard snapshot permission bypassCVE-2026-333798.5 High
- grafana enterprise, oss +1 moreSSO settings authorization bypassCVE-2026-1035068.9 High
- grafana oss, enterprise +1 moreServer-side expression parser denial of serviceCVE-2026-88858Fix available6.5 Medium
- grafana enterprise, oss +1 moreAzure Monitor access token disclosure via SSRFCVE-2026-88967Fix available7.7 High
- grafana enterprise, oss +1 moreAlerting contact point authorization bypass via schema downgradeCVE-2026-100105Public exploitFix available7.7 High
- grafana enterprise, oss +1 moreCVE-2026-16491 CVE RecordCVE-2026-164916.5 Medium
- grafana enterpriseCross-organization user modification and deletion via the SCIM API in Grafana EnterpriseCVE-2026-92539Fix available6.7 Medium
- grafana enterprise, oss +1 moreViewer role can create, modify and delete Loki alerting rulesCVE-2026-9703Fix available7.1 High
- grafana enterprise, oss +1 moreAzure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIsCVE-2026-93294Fix available6.3 Medium
- grafana enterprise, oss +1 moreUnbounded memory allocation in the Prometheus rule conversion APICVE-2026-33374Fix available6.5 Medium
- grafana enterprise, oss +1 moreGit Sync connection configuration can be modified with read-only accessCVE-2026-15577Fix available6.5 Medium
- grafana enterprise, oss, nanogit +2 moreGit Sync memory exhaustion via a malicious Git serverCVE-2026-955025.3 Medium
- grafana enterprise, oss +1 moreEditor can forge file-provisioning provenance on dashboards via the dashboard APICVE-2026-13720Fix available5.4 Medium
- grafana enterprise, oss +1 moreAlert rules in restricted folders disclosed via the alert rules list APICVE-2026-13719Fix available4.3 Medium
- grafana enterprise, oss +1 moreLibrary panel can be moved into a folder without library panel create permissionCVE-2026-81842Fix available4.3 Medium
- grafana enterprise, oss +1 morePaused shared dashboard access tokens still expose data source configurationCVE-2026-81841Fix available5.3 Medium
- grafana enterprise, oss +1 moreOAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectorsCVE-2026-79656Fix available6.0 Medium
- grafana enterprise, oss +1 moreCVE-2026-15815 CVE RecordCVE-2026-15815Fix available8.8 High
- grafana oss, enterprise +1 moreCVE-2026-76154 CVE RecordCVE-2026-76154Fix available7.3 High
- grafana, grafana enterprise, oss +2 moreSession takeover via Auth Proxy cache key collisionCVE-2026-14199Fix available7.1 High
- grafana enterpriseSAML assertion replay via skipped InResponseTo validationCVE-2026-12704Fix available6.8 Medium
- grafana enterprise, oss +1 moreBroken access control in dashboard snapshotsCVE-2026-19197Fix available6.3 Medium
- grafana enterprise, oss +1 moreCVE-2026-17183 CVE RecordCVE-2026-17183Fix available7.1 High
- grafana oss, enterprise +1 moreCVE-2026-11817 CVE RecordCVE-2026-11817Fix available5.3 Medium
- grafana oss, grafana, grafana enterprise +2 moreCross-Organization Public Dashboard Deletion via Missing Org IsolationCVE-2026-28378Fix available3.1 Low
- grafana, grafana enterprise, oss +2 morePre-authentication denial of service in the public dashboard query endpointCVE-2026-42127Fix available7.5 High
- grafana, grafana enterprise +1 moreIncorrect privilege assignmentCVE-2025-41115Public exploitFix availableEPSS 17.5%10.0 Critical
- grafana, grafana enterprise +1 moreGrafana's datasource proxy API allows authorization checks to be bypassedCVE-2025-3454Fix available5.0 Medium
- grafana, grafana enterprise +1 moreThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.
A user with Editor...CVE-2025-2703Fix availableEPSS 16.0%6.8 Medium
- grafana, grafana enterprise +1 moreGrafana plugin data sources vulnerable to access control bypassCVE-2024-6322Fix available4.4 Medium
- grafana, grafana enterprise +1 moreEmail Validation Bypass And Preventing Sign Up From Email's OwnerCVE-2023-6152Fix available5.4 Medium
- grafana, grafana enterprise +1 moreGrafana is an open-source platform for monitoring and observability.
In Grafana Enterprise,...CVE-2023-4399Fix available6.6 Medium
- grafana, grafana enterprise +1 moreGrafana privilege escalation vulnerabilityCVE-2023-4822Fix available6.7 Medium
- grafana, grafana enterprise +1 moreGrafana vulnerable to Authentication Bypass by SpoofingCVE-2023-3128Public exploitFix available9.4 Critical
- grafana, grafana enterprise +1 moreGrafana has Broken Access Control in Alert manager: Viewer can send test alertsCVE-2023-2183Fix available4.1 Medium
- grafana, grafana enterprise +1 moreGrafana Missing Synchronization vulnerabilityCVE-2023-2801Fix available7.5 High
- grafana, grafana enterprise +1 moreGrafana is an open-source platform for monitoring and observability.
Starting with the 9.1...CVE-2023-1387Fix available4.2 Medium
- Show moreLoading…