Skip to contentGrafana Oss vulnerabilities
- grafana elasticsearch datasource, enterprise, oss +2 moreMemory exhaustion denial of service in Elasticsearch data source index patternsCVE-2026-818436.5 Medium
- grafana (built-in) google cloud monitoring datasource, enterprise, oss +2 moreUnintended API access through the Google Cloud Monitoring data source resource proxyCVE-2026-1073655.3 Medium
- grafana elasticsearch datasource, enterprise, oss +2 moreElasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentialsCVE-2026-1064757.1 High
- grafana enterprise, oss, prometheus datasource +2 moreServer-side request forgery in the Prometheus data source resource APICVE-2026-1064726.3 Medium
- grafana enterprise, oss +1 moreGit Sync connections send credentials to unvalidated server URLsCVE-2026-1102895.5 Medium
- grafana oss, enterprise +1 moreCross-instance user impersonation through image renderer JWTsCVE-2026-1025897.1 High
- grafana enterprise, oss +1 moreFolder permission bypass in the Git Sync repository files APICVE-2026-1110247.1 High
- grafana enterprise, oss +1 morePrivilege escalation through folder move in the folders APICVE-2026-1110007.1 High
- grafana enterprise, oss +1 moreMemory exhaustion denial of service in SQL ExpressionsCVE-2026-1075096.5 Medium
- grafana enterprise, oss +1 morePath traversal in Git Sync delete and move jobsCVE-2026-1109926.5 Medium
- grafana enterprise, oss +1 moreTeam preferences RBAC bypass through the set-home-dash endpointCVE-2026-820144.3 Medium
- grafana enterprise, oss +1 moreAuthorization bypass in the Git Sync provisioning jobs APICVE-2026-142426.5 Medium
- grafana enterprise, oss +1 moreFolder authorization bypass in the Git Sync provisioning files APICVE-2026-137216.5 Medium
- grafana enterprise, oss +1 moreDashboard snapshot permission bypassCVE-2026-333798.5 High
- grafana enterprise, oss +1 moreSSO settings authorization bypassCVE-2026-1035068.9 High
- grafana oss, enterprise +1 moreServer-side expression parser denial of serviceCVE-2026-88858Fix available6.5 Medium
- grafana enterprise, oss +1 moreAzure Monitor access token disclosure via SSRFCVE-2026-88967Fix available7.7 High
- grafana enterprise, oss +1 moreAlerting contact point authorization bypass via schema downgradeCVE-2026-100105Public exploitFix available7.7 High
- grafana enterprise, oss +1 moreCVE-2026-16491 CVE RecordCVE-2026-164916.5 Medium
- grafana enterprise, oss +1 moreViewer role can create, modify and delete Loki alerting rulesCVE-2026-9703Fix available7.1 High
- grafana enterprise, oss +1 moreAzure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIsCVE-2026-93294Fix available6.3 Medium
- grafana enterprise, oss +1 moreUnbounded memory allocation in the Prometheus rule conversion APICVE-2026-33374Fix available6.5 Medium
- grafana enterprise, oss +1 moreGit Sync connection configuration can be modified with read-only accessCVE-2026-15577Fix available6.5 Medium
- grafana enterprise, oss, nanogit +2 moreGit Sync memory exhaustion via a malicious Git serverCVE-2026-955025.3 Medium
- grafana enterprise, oss +1 moreEditor can forge file-provisioning provenance on dashboards via the dashboard APICVE-2026-13720Fix available5.4 Medium
- grafana enterprise, oss +1 moreAlert rules in restricted folders disclosed via the alert rules list APICVE-2026-13719Fix available4.3 Medium
- grafana enterprise, oss +1 moreLibrary panel can be moved into a folder without library panel create permissionCVE-2026-81842Fix available4.3 Medium
- grafana enterprise, oss +1 morePaused shared dashboard access tokens still expose data source configurationCVE-2026-81841Fix available5.3 Medium
- grafana enterprise, oss +1 moreOAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectorsCVE-2026-79656Fix available6.0 Medium
- grafana enterprise, oss +1 moreCVE-2026-15815 CVE RecordCVE-2026-15815Fix available8.8 High
- grafana oss, enterprise +1 moreCVE-2026-76154 CVE RecordCVE-2026-76154Fix available7.3 High
- grafana, grafana enterprise, oss +2 moreSession takeover via Auth Proxy cache key collisionCVE-2026-14199Fix available7.1 High
- grafana oss, microsoft sql server datasource, mysql datasource +1 more +3 moreSQL Data Source Plugin: OOM DoS via $__timeGroup macroCVE-2026-19475Fix available6.5 Medium
- grafana enterprise, oss +1 moreBroken access control in dashboard snapshotsCVE-2026-19197Fix available6.3 Medium
- grafana ossCVE-2026-17033 CVE RecordCVE-2026-17033Fix available6.8 Medium
- grafana enterprise, oss +1 moreCVE-2026-17183 CVE RecordCVE-2026-17183Fix available7.1 High
- grafana oss, enterprise +1 moreCVE-2026-11817 CVE RecordCVE-2026-11817Fix available5.3 Medium
- grafana ossCVE-2026-21723 RecordCVE-2026-21723Fix available5.3 Medium
- grafana oss, grafana +1 moreStored XSS in the table panel (TableNG)CVE-2026-8595Fix available6.8 Medium
- grafana, grafana oss +1 morePre-authentication denial of service via the OAuth login routeCVE-2026-8609Fix available5.3 Medium
- grafana, grafana oss +1 moreDenial of service via unbounded request body sizeCVE-2026-33382Fix available7.5 High
- grafana oss, grafana, grafana enterprise +2 moreCross-Organization Public Dashboard Deletion via Missing Org IsolationCVE-2026-28378Fix available3.1 Low
- grafana, grafana enterprise, oss +2 morePre-authentication denial of service in the public dashboard query endpointCVE-2026-42127Fix available7.5 High
- grafana oss, grafana +1 moreStored XSS in the Geomap panel tile-layer attributionCVE-2026-9029Fix available7.3 High
- grafana, grafana oss +1 morePath traversal in the Tempo and Loki data source pluginsCVE-2026-10601Fix available5.4 Medium
- grafana oss, loki datasource +1 morePath traversal in the Loki data source pluginCVE-2026-42129Fix available7.7 High
- grafana, grafana oss +1 moreIDOR in Annotations API allows unprivileged users to DELETE annotationCVE-2026-28374Fix available4.3 Medium
- grafana, grafana oss +1 moreGrafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup MacroCVE-2026-33378Fix available6.5 Medium
- grafana, grafana oss +1 moreGrafana plugin resources can lead to unbounded memory allocationCVE-2026-28383Fix available6.5 Medium
- grafana, grafana oss +1 moreAuth Proxy IPv6 whitelist bypassCVE-2026-33376Fix available7.4 High
- Show moreLoading…