Grafana
98 CVEs across 37 Grafana products. Browse Grafana vulnerabilities, severities, and proof-of-concept exploits.
Grafana products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19516 | Critical | 9.1 | 2026-08-11 | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller al… |
CVE-2026-9765 | High | 7.1 | 2026-07-24 | Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resourc… |
CVE-2026-21723 | Medium | 5.3 | 2026-07-23 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing t… |
CVE-2026-21729 | High | 7.5 | 2026-07-16 | Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. |
CVE-2026-15583 | High | 8.6 | 2026-07-15 | A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-accoun… |
CVE-2026-8609 | Medium | 5.3 | 2026-07-10 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust mem… |
CVE-2026-8595 | Medium | 6.8 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of an… |
CVE-2026-33382 | High | 7.5 | 2026-07-10 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large pa… |
CVE-2026-28378 | Low | 3.1 | 2026-07-07 | The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging… |
CVE-2026-42127 | High | 7.5 | 2026-06-22 | The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocati… |
CVE-2026-9029 | High | 7.3 | 2026-06-22 | A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script the… |
CVE-2026-42129 | High | 7.7 | 2026-06-22 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend config… |
CVE-2026-28381 | Critical | 9.6 | 2026-06-22 | The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between t… |
CVE-2026-10601 | Medium | 5.4 | 2026-06-22 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on… |
CVE-2026-27878 | Medium | 6.5 | 2026-06-19 | A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-… |
CVE-2026-11769 | High | 8.8 | 2026-06-13 | We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerabi… |
CVE-2026-33381 | Medium | 5.9 | 2026-05-13 | When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will… |
CVE-2026-33380 | Medium | 6.3 | 2026-05-13 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlEx… |
CVE-2026-33378 | Medium | 6.5 | 2026-05-13 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the im… |
CVE-2026-33377 | High | 7.1 | 2026-05-13 | An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate… |
CVE-2026-33376 | High | 7.4 | 2026-05-13 | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate ea… |
CVE-2026-28383 | Medium | 6.5 | 2026-05-13 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user… |
CVE-2026-28380 | Medium | 6.5 | 2026-05-13 | Any Editor could delete any snapshot, even if they have no access to read or write them. |
CVE-2026-28379 | Medium | 6.5 | 2026-05-13 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map ac… |
CVE-2026-28376 | Medium | 6.5 | 2026-05-13 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-o… |
CVE-2026-28374 | Medium | 4.3 | 2026-05-13 | Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. |
CVE-2026-21728 | High | 7.5 | 2026-04-24 | Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mit… |
CVE-2026-21727 | Low | 3.3 | 2026-04-15 | --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Leg… |
CVE-2026-21726 | Medium | 5.3 | 2026-04-15 | The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If th… |
CVE-2025-12141 | Medium | 6.5 | 2026-04-15 | In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications… |
CVE-2026-28375 | Medium | 6.5 | 2026-03-27 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27880 | High | 7.5 | 2026-03-27 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. |
CVE-2026-27879 | Medium | 6.5 | 2026-03-27 | A resample query can be used to trigger out-of-memory crashes in Grafana. |
CVE-2026-27877 | Medium | 6.5 | 2026-03-27 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of pro… |
CVE-2026-27876 | Critical | 9.1 | 2026-03-27 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature i… |
CVE-2026-28377 | High | 7.5 | 2026-03-26 | A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users… |
CVE-2026-33375 | Medium | 6.5 | 2026-03-26 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out… |
CVE-2026-21724 | Medium | 5.4 | 2026-03-26 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify… |
CVE-2026-21725 | Low | 2.6 | 2026-02-25 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requi… |
CVE-2026-21722 | Medium | 5.3 | 2026-02-12 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read… |
CVE-2025-41117 | Medium | 6.8 | 2026-02-12 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious Ja… |
CVE-2026-21721 | High | 8.1 | 2026-01-27 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permi… |
CVE-2026-21720 | High | 7.5 | 2026-01-27 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three se… |
CVE-2025-41115 | Critical | 10.0 | 2025-11-21 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-10630 | Medium | 4.3 | 2025-09-19 | Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix a… |
CVE-2025-8341 | Medium | 5.0 | 2025-08-04 | Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from J… |
CVE-2025-6197 | Medium | 4.2 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizat… |
CVE-2025-6023 | High | 7.6 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11… |
CVE-2025-3415 | Medium | 4.3 | 2025-07-17 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed… |
CVE-2025-1088 | Low | 2.7 | 2025-06-18 | In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerabilit… |
CVE-2025-3454 | Medium | 5.0 | 2025-06-02 | This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with… |
CVE-2025-3260 | High | 8.3 | 2025-06-02 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerabilit… |
CVE-2025-3580 | Medium | 5.5 | 2025-05-23 | An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. Th… |
CVE-2025-4123 | High | 7.6 | 2025-05-22 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect u… |
CVE-2025-2703 | Medium | 6.8 | 2025-04-23 | The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it exec… |
CVE-2024-11741 | Medium | 4.3 | 2025-01-31 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be expose… |
CVE-2024-10452 | Low | 2.2 | 2024-10-29 | Organization admins can delete pending invites created in an organization they are not part of. |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-8118 | | 2024-09-26 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also writ… | |
CVE-2024-8996 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects… |
CVE-2024-8975 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: befor… |
CVE-2024-6322 | Medium | 5.4 | 2024-08-20 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associat… |
CVE-2024-5526 | High | 7.7 | 2024-06-05 | Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tai… |
CVE-2024-1313 | Medium | 6.5 | 2024-03-26 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to… |
CVE-2024-1442 | Medium | 6.0 | 2024-03-07 | A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to re… |
CVE-2023-5123 | High | 8.0 | 2024-02-14 | The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows fo… |
CVE-2023-5122 | Medium | 5.0 | 2024-02-14 | Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for… |
CVE-2023-6152 | Medium | 5.4 | 2024-02-13 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_e… |
CVE-2023-3010 | High | 7.3 | 2023-10-25 | Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability. |
CVE-2023-4399 | Medium | 6.6 | 2023-10-17 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure G… |
CVE-2023-4457 | Medium | 5.5 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable… |
CVE-2023-4822 | Medium | 6.7 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user… |
CVE-2023-3128 | Critical | 9.4 | 2023-06-22 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads… |
CVE-2023-2801 | High | 7.5 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queri… |
CVE-2023-2183 | Medium | 4.1 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having… |
CVE-2023-1387 | Medium | 4.2 | 2023-04-26 | Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the… |
CVE-2023-1410 | Medium | 6.2 | 2023-03-23 | Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. Th… |
CVE-2023-22462 | Medium | 6.4 | 2023-03-02 | Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a s… |
CVE-2023-0594 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view v… |
CVE-2023-0507 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core… |
CVE-2022-23498 | High | 7.1 | 2023-02-03 | Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_s… |
CVE-2022-39324 | Medium | 6.7 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily c… |
CVE-2022-23552 | High | 7.3 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had… |
CVE-2022-44643 | Medium | 5.7 | 2022-12-20 | A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy… |
CVE-2022-46156 | High | 7.2 | 2022-11-30 | The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote ta… |
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-39306 | Medium | 6.4 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Valida… |
CVE-2022-39328 | Critical | 9.8 | 2022-11-08 | Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentic… |
CVE-2022-39229 | Medium | 4.3 | 2022-10-13 | Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's… |
CVE-2022-39201 | Medium | 6.8 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana coul… |
CVE-2022-31130 | Medium | 4.9 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication… |
CVE-2022-31123 | Medium | 6.1 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature… |
CVE-2022-36062 | High | 7.6 | 2022-09-22 | Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation… |
CVE-2022-35957 | Medium | 6.6 | 2022-09-20 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server ad… |
CVE-2022-31176 | High | 8.3 | 2022-09-02 | Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An interna… |
CVE-2022-31107 | High | 7.1 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious use… |
CVE-2022-31097 | High | 7.3 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerabl… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |