Grafana Grafana Enterprise
32 CVEs affecting Grafana Grafana Enterprise. Latest disclosed: 2026-10-15. Critical: 2, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41115 | Critical | 10.0 | 2025-11-21 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing… |
CVE-2023-3128 | Critical | 9.4 | 2023-06-22 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads… |
CVE-2026-15815 | High | 8.8 | 2026-09-17 | Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic… |
CVE-2026-42127 | High | 7.5 | 2026-06-22 | The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocati… |
CVE-2023-2801 | High | 7.5 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queri… |
CVE-2026-76154 | High | 7.3 | 2026-09-17 | A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in ano… |
CVE-2023-0594 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view v… |
CVE-2023-0507 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core… |
CVE-2026-9703 | High | 7.1 | 2026-10-15 | Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an… |
CVE-2026-14199 | High | 7.1 | 2026-09-02 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache… |
CVE-2026-17183 | High | 7.1 | 2026-08-19 | An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side e… |
CVE-2026-12704 | Medium | 6.8 | 2026-09-02 | When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP… |
CVE-2025-2703 | Medium | 6.8 | 2025-04-23 | The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it exec… |
CVE-2023-4822 | Medium | 6.7 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user… |
CVE-2023-4399 | Medium | 6.6 | 2023-10-17 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure G… |
CVE-2026-33374 | Medium | 6.5 | 2026-10-13 | The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations th… |
CVE-2026-15577 | Medium | 6.5 | 2026-10-13 | A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (… |
CVE-2026-93294 | Medium | 6.3 | 2026-10-13 | A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the da… |
CVE-2026-19197 | Medium | 6.3 | 2026-08-26 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recove… |
CVE-2023-1410 | Medium | 6.2 | 2023-03-23 | Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. Th… |