Security Advisories

Published	CVE	Severity (CVSS)	Product	Advisory Title	Updated
2026-07-22	CVE-2026-21723	Medium (5.3)	Grafana	DoS Vulnerability in Templates Test endpoint	—
2026-07-15	CVE-2026-15583	High (8.6)	Grafana MCP	Grafana MCP server-side request forgery via X-Grafana-URL header	—
2026-07-15	CVE-2026-21729	Medium (7.5)	Loki	Loki detected_fields query limits results in unbounded memory allocation	—
2026-06-13	CVE-2026-11769	MEDIUM (6.4)	Grafana	Operator - Namespaced User Path Traversal	—
2026-06-09	CVE-2026-33382	High (7.5)	Grafana	Grafana denial of service via oversized request bodies (web.Bind)	—
2026-06-09	CVE-2026-42129	High (7.7)	Grafana	Path traversal in the Loki data source leads to internal information disclosure	—
2026-06-09	CVE-2026-10601	Medium (5.4)	Grafana	Path traversal in the Tempo and Loki data source plugins	—
2026-06-09	CVE-2026-8609	Medium (5.3)	Grafana	Pre-authentication denial of service in the OAuth login route	—
2026-06-09	CVE-2026-42127	High (7.5)	Grafana	Pre-authentication denial of service in the public dashboard query handler	—
2026-06-09	CVE-2026-9029	High (7.3)	Grafana	Stored XSS in the Geomap panel tile-layer attribution	—
2026-06-09	CVE-2026-8595	Medium (6.8)	Grafana	Stored XSS in the table panel (TableNG)	—
2026-05-13	CVE-2026-33376	High (7.4)	Grafana	Auth Proxy IPv6 whitelist bypass	—
2026-05-13	CVE-2026-28380	Medium (6.5)	Grafana	BAC in Snapshot API allows deletion of unauthorized dashboard snapshots	—
2026-05-13	CVE-2026-33377	High (7.1)	Grafana	Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin	—
2026-05-13	CVE-2026-33378	Medium (6.5)	Grafana	Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro	—
2026-05-13	CVE-2026-28376	Medium (6.5)	Grafana	Grafana Live push endpoint allows unbounded memory allocation leading to OOM	—
2026-05-13	CVE-2026-28383	Medium (6.5)	Grafana	Grafana plugin resources can lead to unbounded memory allocation	—
2026-05-13	CVE-2026-28374	Medium (4.3)	Grafana	IDOR in Annotations API allows unprivileged users to DELETE annotation	—
2026-05-13	CVE-2026-33380	Medium (6.3)	Grafana	SQL Expressions Read File From Disk	—
2026-05-13	CVE-2026-33381	Medium (5.9)	Grafana	Users can generate Service Account tokens after permissions removal	—
2026-05-13	CVE-2026-28379	Medium (6.5)	Grafana	Viewer-triggered race condition in Grafana Live leads to complete server crash	—
2026-05-02	CVE-2026-28381	CRITICAL (9.6)	Grafana	Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT	—
2026-04-24	CVE-2026-21728	High (7.5)	Tempo	Tempo query limit results in unbounded memory allocation	—
2026-03-30	CVE-2026-28375	Medium (6.5)	Grafana	Grafana Testdata datasource can issue unbounded memory allocations	—
2026-03-30	CVE-2026-27880	High (7.5)	Grafana	OpenFeature evaluation API reads input data with no bounds	—
2026-03-30	CVE-2026-27877	Medium (6.5)	Grafana	Public dashboards discloses all direct mode datasources	—
2026-03-30	CVE-2026-27879	Medium (6.5)	Grafana	Query resampling can cause unbounded memory allocations	—
2026-03-30	CVE-2026-27876	Critical (9.1)	Grafana	RCE on Grafana via sqlExpressions	—
2026-03-25	CVE-2026-33375	Medium (6.5)	Grafana	Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS	—
2026-03-25	CVE-2026-21724	Medium (5.4)	Grafana	Missing Protected-field Authorization in Provisioning Contact Points API	—
2026-03-24	CVE-2026-28378	Low (3.1)	Grafana	Cross-Organization Public Dashboard Deletion via Missing Org Isolation	—
2026-03-23	CVE-2026-27878	Medium (6.5)	Tempo	Tempo denial of service via TraceQL exemplars hint (TraceQL query execution)	—
2026-03-16	CVE-2026-28377	High (7.5)	Tempo	S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint	—
2026-02-25	CVE-2026-21725	Low (2.6)	Grafana	Authorization bypass in Grafana datasource deletion	—
2026-02-12	CVE-2026-21722	Medium (5.3)	Grafana	Public Dashboards time range restriction on annotations can be bypassed	—
2026-02-12	CVE-2025-41117	Medium (6.8)	Grafana	XSS in Grafana Explore stack trace	—
2026-01-29	CVE-2026-21727	Low (3.3)	Grafana	Cross-Tenant Legacy Correlation Disclosure and Deletion	—
2026-01-27	CVE-2026-21721	High (8.1)	Grafana	Cross-dashboard privilege escalation via permission management	—
2026-01-27	CVE-2026-21720	High (7.5)	Grafana	Unauthenticated DoS in avatar cache in Grafana	—
2026-01-26	CVE-2026-21726	Medium (5.3)	Loki	Open Redirect Loki Path Traversal - CVE-2021-36156 Bypass	—
2026-01-02	CVE-2025-41118	Critical (9.1)	Pyroscope	Exposure of Storage Secret in Pyroscope	—
2025-12-16	CVE-2025-12141	Low (1.3)	Grafana	Grafana Alerting Editors can edit destination of webhooks they did not create	—
2025-11-19	CVE-2025-41115	Critical (10.0)	Grafana Enterprise	Incorrect privilege assignment	—
2025-11-11	CVE-2025-41116	Low (2.1)	Grafana Databricks Datasource Plugin	Incorrect OAuth Passthrough in Grafana Databricks Datasource	—
2025-11-11	CVE-2025-3717	Low (2.1)	Grafana Snowflake Datasource Plugin	Incorrect OAuth Passthrough in Grafana Snowflake Datasource	—
2025-10-09	CVE-2025-11539	Critical (9.9)	Grafana Image Renderer Plugin	Arbitrary Code Execution in Grafana Image Renderer Plugin	—
2025-09-19	CVE-2025-10630	Low (4.3)	Grafana Zabbix Plugin	Regex DoS in Zabbix Plugin	2026-06-01
2025-08-04	CVE-2025-8341	Medium (6.1)	Grafana Infinity Plugin	SSRF in Infinity Plugin in Grafana	—
2025-07-18	CVE-2025-6197	Medium (4.2)	Grafana	Open Redirect in Organization Switching in Grafana	—
2025-07-18	CVE-2025-6023	High (7.6)	Grafana	XSS in Scripted Dashboards in Grafana	—
2025-07-17	CVE-2025-3415	Medium (4.3)	Grafana	Information Disclosure in DingDing Integration in Grafana	—
2025-06-17	CVE-2025-1088	Low (2.7)	Grafana	DoS in Dashboard Titles in Grafana	—
2025-06-02	CVE-2025-3260	High (8.3)	Grafana	Authorization Bypass in Dashboard API in Grafana	—
2025-06-02	CVE-2025-3454	Medium (5.0)	Grafana	Authorization Bypass in Data Source Proxy in Grafana	—
2025-05-22	CVE-2025-3580	Medium (5.5)	Grafana	Privilege Escalation in Admin Management in Grafana	—
2025-05-21	CVE-2025-4123	High (7.6)	Grafana	XSS in Frontend Plugins in Grafana	—
2025-04-23	CVE-2025-2703	Medium (6.8)	Grafana	XSS in XY Chart Plugin in Grafana	—
2025-01-31	CVE-2024-11741	Medium (4.3)	Grafana	Information Disclosure in VictorOps Integration in Grafana	—
2024-11-12	CVE-2024-9476	Medium (5.1)	Grafana	Privilege Escalation in Organizations in Grafana	—
2024-10-28	CVE-2024-10452	Low (2.2)	Grafana	Authorization Bypass in Invitations in Grafana	—
2024-10-17	CVE-2024-9264	Critical (9.4)	Grafana	Remote Code Execution in SQL Expressions in Grafana	—
2024-09-26	CVE-2024-8118	Medium (5.1)	Grafana	Permission Error in Alerting API in Grafana	—
2024-09-25	CVE-2024-8996	High (7.3)	Grafana Agent	Privilege Escalation in Service Path in Grafana Agent	—
2024-09-25	CVE-2024-8975	High (7.3)	Grafana Alloy	Privilege Escalation in Service Path in Grafana Alloy	—
2024-09-19	CVE-2024-8986	Critical (9.1)	Grafana Plugin SDK	Information Disclosure in Plugin SDK in Grafana	—
2024-07-23	CVE-2024-6322	Medium (4.4)	Grafana	Authorization Bypass in Plugin Routes in Grafana	—
2024-05-30	CVE-2024-5526	High (7.7)	Grafana OnCall	SSRF in Webhooks in Grafana OnCall	—
2024-03-26	CVE-2024-1313	Medium (6.5)	Grafana	Authorization Bypass in Snapshots in Grafana	—
2024-03-07	CVE-2024-1442	Medium (6.0)	Grafana	Privilege Escalation in Data Sources in Grafana	—
2024-02-14	CVE-2023-5123	High (8.0)	Grafana JSON Plugin	Path Traversal in JSON Plugin in Grafana	2024-06-18
2024-02-14	CVE-2023-5122	Medium (5.0)	Grafana CSV Plugin	SSRF in CSV Plugin in Grafana	—
2024-02-13	CVE-2023-6152	Medium (5.4)	Grafana	Verification Bypass in Email Settings in Grafana	—
2023-10-12	CVE-2023-4399	Medium (6.6)	Grafana	Network Restriction Bypass in Data Sources in Grafana	—
2023-10-12	CVE-2023-4822	Medium (6.7)	Grafana	Privilege Escalation in Organizations in Grafana	—
2023-09-19	CVE-2023-4457	Medium (5.5)	Grafana Google Sheets Plugin	Information Disclosure in Google Sheets Plugin in Grafana	—
2023-06-22	CVE-2023-3128	Critical (9.4)	Grafana	Authentication Bypass in Azure AD OAuth in Grafana	—
2023-06-08	CVE-2023-3010	High (7.3)	Grafana WorldMap Plugin	XSS in WorldMap Plugin in Grafana	—
2023-06-06	CVE-2023-2183	High (7.5)	Grafana	Authorization Bypass in Alerting in Grafana	—
2023-06-06	CVE-2023-2801	High (7.5)	Grafana	Race Condition in Data Source Proxy in Grafana	—
2023-04-26	CVE-2023-1387	Medium (4.2)	Grafana	Token Leakage in URL Login in Grafana	—
2023-03-22	CVE-2023-1410	Medium (6.2)	Grafana	XSS in Graphite Functions in Grafana	—
2023-02-28	CVE-2023-0507	High (7.3)	Grafana	XSS in Geomap in Grafana	—
2023-02-28	CVE-2023-22462	Medium (6.4)	Grafana	XSS in Text Panel in Grafana	—
2023-02-28	CVE-2023-0594	High (7.3)	Grafana	XSS in TraceView in Grafana	—
2023-02-01	CVE-2022-23498	High (7.1)	Grafana	Information Disclosure in Query Cache in Grafana	—
2023-01-26	CVE-2022-39324	Medium (6.7)	Grafana	URL Spoofing in Snapshots in Grafana	—
2023-01-26	CVE-2022-23552	High (7.3)	Grafana	XSS in ResourcePicker in Grafana	—
2022-11-08	CVE-2022-39307	Medium (6.7)	Grafana	Information Disclosure in Password Reset in Grafana	—
2022-11-08	CVE-2022-39306	Medium (6.4)	Grafana	Input Validation Bypass in User Registration in Grafana	—
2022-11-08	CVE-2022-39328	Critical (9.8)	Grafana	Race Condition in Authentication in Grafana	—
2022-10-12	CVE-2022-39201	Medium (6.8)	Grafana	Cookie Leakage in Proxy in Grafana	—
2022-10-12	CVE-2022-31123	Medium (6.1)	Grafana	Signature Bypass in Plugin System in Grafana	—
2022-10-12	CVE-2022-31130	Medium (4.9)	Grafana	Token Leakage in Proxy in Grafana	—
2022-10-12	CVE-2022-39229	Medium (4.3)	Grafana	User Enumeration in Login in Grafana	—
2022-09-20	CVE-2022-35957	Medium (6.6)	Grafana	Privilege Escalation in Auth Proxy in Grafana	—
2022-09-20	CVE-2022-36062	High (7.1)	Grafana	Privilege Escalation in Folder Permissions in Grafana	—
2022-08-30	CVE-2022-31176	High (7.6)	Grafana Image Renderer Plugin	File Disclosure in Image Renderer in Grafana	—
2022-07-14	CVE-2022-31107	High (7.1)	Grafana	Account Takeover in OAuth in Grafana	—
2022-07-14	CVE-2022-31097	High (7.3)	Grafana	XSS in Unified Alerting in Grafana	—
2022-05-19	CVE-2022-29170	Medium (6.6)	Grafana	Network Restriction Bypass in Data Sources in Grafana	—
2022-04-12	CVE-2022-24812	High (8.0)	Grafana	Privilege Escalation in API Keys in Grafana	—
2022-02-08	CVE-2022-21703	Medium (6.3)	Grafana	CSRF in Web Interface in Grafana	—
2022-02-08	CVE-2022-21713	Medium (4.3)	Grafana	IDOR in Teams API in Grafana	—
2022-02-08	CVE-2022-21702	Medium (6.5)	Grafana	XSS in Proxy in Grafana	—
2022-01-18	CVE-2022-21673	Medium (4.3)	Grafana	Token Leakage in OAuth in Grafana	—

Security Advisories

Still have questions?

Get every update