Security

Security Advisories

Showing 24 results, page 2 of 6

Published CVE records
CVESeverity (CVSS)Advisory Title
CVE-2026-42127High (7.5)Pre-authentication denial of service in the public dashboard query handler
CVE-2026-9029High (7.3)Stored XSS in the Geomap panel tile-layer attribution
CVE-2026-8595Medium (6.8)Stored XSS in the table panel (TableNG)
CVE-2026-33376High (7.4)Auth Proxy IPv6 whitelist bypass
CVE-2026-28380Medium (6.5)BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
CVE-2026-33377High (7.1)Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
CVE-2026-33378Medium (6.5)Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
CVE-2026-28376Medium (6.5)Grafana Live push endpoint allows unbounded memory allocation leading to OOM
CVE-2026-28383Medium (6.5)Grafana plugin resources can lead to unbounded memory allocation
CVE-2026-28374Medium (4.3)IDOR in Annotations API allows unprivileged users to DELETE annotation
CVE-2026-33380Medium (6.3)SQL Expressions Read File From Disk
CVE-2026-33381Medium (5.9)Users can generate Service Account tokens after permissions removal
CVE-2026-28379Medium (6.5)Viewer-triggered race condition in Grafana Live leads to complete server crash
CVE-2026-28381Critical (9.6)Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVE-2026-21728High (7.5)Tempo query limit results in unbounded memory allocation
CVE-2026-28375Medium (6.5)Grafana Testdata datasource can issue unbounded memory allocations
CVE-2026-27880High (7.5)OpenFeature evaluation API reads input data with no bounds
CVE-2026-27877Medium (6.5)Public dashboards discloses all direct mode datasources
CVE-2026-27879Medium (6.5)Query resampling can cause unbounded memory allocations
CVE-2026-27876Critical (9.1)RCE on Grafana via sqlExpressions
CVE-2026-33375Medium (6.5)Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
CVE-2026-21724Medium (5.4)Missing Protected-field Authorization in Provisioning Contact Points API
CVE-2026-28378Low (3.1)Cross-Organization Public Dashboard Deletion via Missing Org Isolation
CVE-2026-27878Medium (6.5)Tempo denial of service via TraceQL exemplars hint (TraceQL query execution)

Security Advisories | Grafana Labs