Grafana vulnerabilities
141 CVEs and advisories name Grafana as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-33379Dashboard snapshot permission bypass
- CVE-2026-81938Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir
- CVE-2026-79656OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
- CVE-2026-103506SSO settings authorization bypass
- CVE-2026-88858Server-side expression parser denial of service
- CVE-2026-88967Azure Monitor access token disclosure via SSRF
- CVE-2026-100105Alerting contact point authorization bypass via schema downgrade
- CVE-2026-16491CVE-2026-16491 CVE Record
- CVE-2026-92539Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
- CVE-2026-9703Viewer role can create, modify and delete Loki alerting rules
- CVE-2026-33374Unbounded memory allocation in the Prometheus rule conversion API
- CVE-2026-15577Git Sync connection configuration can be modified with read-only access
- CVE-2026-93294Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- CVE-2026-95502Git Sync memory exhaustion via a malicious Git server
- CVE-2026-89039Arbitrary file read via the convert_playwright_script prompt in mcp-k6
- CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API
- CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API
- CVE-2026-81842Library panel can be moved into a folder without library panel create permission
- CVE-2026-81841Paused shared dashboard access tokens still expose data source configuration
- CVE-2026-15815CVE-2026-15815 CVE Record
- CVE-2026-76154CVE-2026-76154 CVE Record
- CVE-2026-14199Session takeover via Auth Proxy cache key collision
- CVE-2026-12704SAML assertion replay via skipped InResponseTo validation
- CVE-2026-19475SQL Data Source Plugin: OOM DoS via $__timeGroup macro
- CVE-2026-75889CVE-2026-75889 CVE Record
- CVE-2026-19854CVE-2026-19854 CVE Record
- CVE-2026-19197Broken access control in dashboard snapshots
- CVE-2026-17033CVE-2026-17033 CVE Record
- CVE-2026-17183CVE-2026-17183 CVE Record
- CVE-2026-11817CVE-2026-11817 CVE Record