# cve.now: Grafana

The newest entries naming Grafana as an affected vendor (up to 200), of 141 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-33379](https://cve.now/CVE-2026-33379.md): Dashboard snapshot permission bypass (CVSS 8.5)
- [CVE-2026-81938](https://cve.now/CVE-2026-81938.md): Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir (CVSS 7.7)
- [CVE-2026-79656](https://cve.now/CVE-2026-79656.md): OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors (CVSS 6.0)
- [CVE-2026-103506](https://cve.now/CVE-2026-103506.md): SSO settings authorization bypass (CVSS 8.9)
- [CVE-2026-88858](https://cve.now/CVE-2026-88858.md): Server-side expression parser denial of service (CVSS 6.5)
- [CVE-2026-88967](https://cve.now/CVE-2026-88967.md): Azure Monitor access token disclosure via SSRF (CVSS 7.7)
- [CVE-2026-100105](https://cve.now/CVE-2026-100105.md): Alerting contact point authorization bypass via schema downgrade (CVSS 7.7)
- [CVE-2026-16491](https://cve.now/CVE-2026-16491.md): CVE-2026-16491 CVE Record (CVSS 6.5)
- [CVE-2026-92539](https://cve.now/CVE-2026-92539.md): Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise (CVSS 6.7)
- [CVE-2026-9703](https://cve.now/CVE-2026-9703.md): Viewer role can create, modify and delete Loki alerting rules (CVSS 7.1)
- [CVE-2026-33374](https://cve.now/CVE-2026-33374.md): Unbounded memory allocation in the Prometheus rule conversion API (CVSS 6.5)
- [CVE-2026-15577](https://cve.now/CVE-2026-15577.md): Git Sync connection configuration can be modified with read-only access (CVSS 6.5)
- [CVE-2026-93294](https://cve.now/CVE-2026-93294.md): Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs (CVSS 6.3)
- [CVE-2026-95502](https://cve.now/CVE-2026-95502.md): Git Sync memory exhaustion via a malicious Git server (CVSS 5.3)
- [CVE-2026-89039](https://cve.now/CVE-2026-89039.md): Arbitrary file read via the convert\_playwright\_script prompt in mcp-k6 (CVSS 6.5)
- [CVE-2026-13720](https://cve.now/CVE-2026-13720.md): Editor can forge file-provisioning provenance on dashboards via the dashboard API (CVSS 5.4)
- [CVE-2026-13719](https://cve.now/CVE-2026-13719.md): Alert rules in restricted folders disclosed via the alert rules list API (CVSS 4.3)
- [CVE-2026-81842](https://cve.now/CVE-2026-81842.md): Library panel can be moved into a folder without library panel create permission (CVSS 4.3)
- [CVE-2026-81841](https://cve.now/CVE-2026-81841.md): Paused shared dashboard access tokens still expose data source configuration (CVSS 5.3)
- [CVE-2026-15815](https://cve.now/CVE-2026-15815.md): CVE-2026-15815 CVE Record (CVSS 8.8)
- [CVE-2026-76154](https://cve.now/CVE-2026-76154.md): CVE-2026-76154 CVE Record (CVSS 7.3)
- [CVE-2026-14199](https://cve.now/CVE-2026-14199.md): Session takeover via Auth Proxy cache key collision (CVSS 7.1)
- [CVE-2026-12704](https://cve.now/CVE-2026-12704.md): SAML assertion replay via skipped InResponseTo validation (CVSS 6.8)
- [CVE-2026-19475](https://cve.now/CVE-2026-19475.md): SQL Data Source Plugin: OOM DoS via $\_\_timeGroup macro (CVSS 6.5)
- [CVE-2026-75889](https://cve.now/CVE-2026-75889.md): CVE-2026-75889 CVE Record (CVSS 7.7)
- [CVE-2026-19854](https://cve.now/CVE-2026-19854.md): CVE-2026-19854 CVE Record (CVSS 6.1)
- [CVE-2026-19197](https://cve.now/CVE-2026-19197.md): Broken access control in dashboard snapshots (CVSS 6.3)
- [CVE-2026-17033](https://cve.now/CVE-2026-17033.md): CVE-2026-17033 CVE Record (CVSS 6.8)
- [CVE-2026-17183](https://cve.now/CVE-2026-17183.md): CVE-2026-17183 CVE Record (CVSS 7.1)
- [CVE-2026-11817](https://cve.now/CVE-2026-11817.md): CVE-2026-11817 CVE Record (CVSS 5.3)
- [CVE-2026-19516](https://cve.now/CVE-2026-19516.md): CVE-2026-19516 CVE Record (CVSS 9.1)
- [CVE-2026-9765](https://cve.now/CVE-2026-9765.md): CVE-2026-9765 CVE Record (CVSS 7.1)
- [CVE-2026-21723](https://cve.now/CVE-2026-21723.md): CVE-2026-21723 Record (CVSS 5.3)
- [CVE-2026-21729](https://cve.now/CVE-2026-21729.md): Loki detected\_fields query limits results in unbounded memory allocation (CVSS 7.5)
- [CVE-2026-15583](https://cve.now/CVE-2026-15583.md): SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header (CVSS 8.6)
- [CVE-2026-8595](https://cve.now/CVE-2026-8595.md): Stored XSS in the table panel (TableNG) (CVSS 6.8)
- [CVE-2026-8609](https://cve.now/CVE-2026-8609.md): Pre-authentication denial of service via the OAuth login route (CVSS 5.3)
- [CVE-2026-33382](https://cve.now/CVE-2026-33382.md): Denial of service via unbounded request body size (CVSS 7.5)
- [CVE-2026-28378](https://cve.now/CVE-2026-28378.md): Cross-Organization Public Dashboard Deletion via Missing Org Isolation (CVSS 3.1)
- [CVE-2026-42127](https://cve.now/CVE-2026-42127.md): Pre-authentication denial of service in the public dashboard query endpoint (CVSS 7.5)
- [CVE-2026-28381](https://cve.now/CVE-2026-28381.md): Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT (CVSS 9.6)
- [CVE-2026-9029](https://cve.now/CVE-2026-9029.md): Stored XSS in the Geomap panel tile-layer attribution (CVSS 7.3)
- [CVE-2026-10601](https://cve.now/CVE-2026-10601.md): Path traversal in the Tempo and Loki data source plugins (CVSS 5.4)
- [CVE-2026-42129](https://cve.now/CVE-2026-42129.md): Path traversal in the Loki data source plugin (CVSS 7.7)
- [CVE-2026-27878](https://cve.now/CVE-2026-27878.md): Tempo TraceQL query with exemplar hint could result in unbounded memory usage (CVSS 6.5)
- [CVE-2026-11769](https://cve.now/CVE-2026-11769.md): Operator - Namespaced User Path Traversal (CVSS 6.4)
- [CVE-2026-28374](https://cve.now/CVE-2026-28374.md): IDOR in Annotations API allows unprivileged users to DELETE annotation (CVSS 4.3)
- [CVE-2026-33378](https://cve.now/CVE-2026-33378.md): Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $\_\_timeGroup Macro (CVSS 6.5)
- [CVE-2026-28383](https://cve.now/CVE-2026-28383.md): Grafana plugin resources can lead to unbounded memory allocation (CVSS 6.5)
- [CVE-2026-33376](https://cve.now/CVE-2026-33376.md): Auth Proxy IPv6 whitelist bypass (CVSS 7.4)
- [CVE-2026-33380](https://cve.now/CVE-2026-33380.md): SQL Expressions Read File From Disk (CVSS 6.3)
- [CVE-2026-28380](https://cve.now/CVE-2026-28380.md): BAC in Snapshot API allows deletion of unauthorized dashboard snapshots (CVSS 6.5)
- [CVE-2026-33381](https://cve.now/CVE-2026-33381.md): Users can generate Service Account tokens after permissions removal (CVSS 5.9)
- [CVE-2026-33377](https://cve.now/CVE-2026-33377.md): Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin (CVSS 7.1)
- [CVE-2026-28376](https://cve.now/CVE-2026-28376.md): Grafana Live push endpoint allows unbounded memory allocation leading to OOM (CVSS 6.5)
- [CVE-2026-28379](https://cve.now/CVE-2026-28379.md): Viewer-triggered race condition in Grafana Live leads to complete server crash (CVSS 6.5)
- [CVE-2026-21728](https://cve.now/CVE-2026-21728.md): Tempo query limit results in unbounded memory allocation (CVSS 7.5)
- [CVE-2026-21726](https://cve.now/CVE-2026-21726.md): Loki Path Traversal - CVE-2021-36156 Bypass (CVSS 5.3)
- [CVE-2025-41118](https://cve.now/CVE-2025-41118.md): Sensitive COS \`SecretKey\` exposed in plaintext via configuration API due to missing type protection (CVSS 9.1)
- [CVE-2026-21727](https://cve.now/CVE-2026-21727.md): Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org\_id=0 Record (CVSS 3.3)
- [CVE-2025-12141](https://cve.now/CVE-2025-12141.md): Grafana Alerting Editors can edit destination of webhooks they did not create (CVSS 1.3)
- [CVE-2026-27879](https://cve.now/CVE-2026-27879.md): Query resampling can cause unbounded memory allocations (CVSS 6.5)
- [CVE-2026-28375](https://cve.now/CVE-2026-28375.md): Grafana Testdata datasource can issue unbounded memory allocations (CVSS 6.5)
- [CVE-2026-27876](https://cve.now/CVE-2026-27876.md): RCE on Grafana via sqlExpressions (CVSS 9.1)
- [CVE-2026-27880](https://cve.now/CVE-2026-27880.md): OpenFeature evaluation API reads input data with no bounds (CVSS 7.5)
- [CVE-2026-27877](https://cve.now/CVE-2026-27877.md): Public dashboards discloses all direct mode datasources (CVSS 6.5)
- [CVE-2026-28377](https://cve.now/CVE-2026-28377.md): S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) (CVSS 7.5)
- [CVE-2026-21724](https://cve.now/CVE-2026-21724.md): Missing Protected-field Authorization in Provisioning Contact Points API (CVSS 5.4)
- [CVE-2026-33375](https://cve.now/CVE-2026-33375.md): Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS (CVSS 6.5)
- [CVE-2026-21725](https://cve.now/CVE-2026-21725.md): Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name (CVSS 2.6)
- [CVE-2025-41117](https://cve.now/CVE-2025-41117.md): XSS in Grafana Explore stack trace (CVSS 6.8)
- [CVE-2026-21722](https://cve.now/CVE-2026-21722.md): Public Dashboards time range restriction on annotations can be bypassed (CVSS 5.3)
- [CVE-2026-21721](https://cve.now/CVE-2026-21721.md): Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation (CVSS 8.1)
- [CVE-2026-21720](https://cve.now/CVE-2026-21720.md): Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out (CVSS 7.5)
- [CVE-2025-41115](https://cve.now/CVE-2025-41115.md): Incorrect privilege assignment (CVSS 10.0)
- [CVE-2025-11539](https://cve.now/CVE-2025-11539.md): Arbitrary Code Execution in Grafana Image Renderer Plugin (CVSS 9.9)
- [CVE-2025-10630](https://cve.now/CVE-2025-10630.md): Regex DoS in Grafana Zabbix Plugin (CVSS 4.3)
- [CVE-2025-8341](https://cve.now/CVE-2025-8341.md): SSRF in Infinity Datasource Plugin (CVSS 5.0)
- [CVE-2025-6197](https://cve.now/CVE-2025-6197.md): An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. (CVSS 4.2)
- [CVE-2025-6023](https://cve.now/CVE-2025-6023.md): An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. (CVSS 7.6)
- [CVE-2025-3415](https://cve.now/CVE-2025-3415.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.3)
- [CVE-2025-1088](https://cve.now/CVE-2025-1088.md): Very long unicode dashboard title or panel name can hang the frontend (CVSS 2.7)
- [CVE-2025-3454](https://cve.now/CVE-2025-3454.md): This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the UR (CVSS 5.0)
- [CVE-2025-3260](https://cve.now/CVE-2025-3260.md): A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder… (CVSS 8.3)
- [CVE-2025-3580](https://cve.now/CVE-2025-3580.md): An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server admini (CVSS 5.5)
- [CVE-2025-4123](https://cve.now/CVE-2025-4123.md): A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. (CVSS 7.6)
- [CVE-2025-2703](https://cve.now/CVE-2025-2703.md): The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. (CVSS 6.8)
- [CVE-2024-11741](https://cve.now/CVE-2024-11741.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.3)
- [CVE-2024-10452](https://cve.now/CVE-2024-10452.md): Organization admins can delete pending invites created in an organization they are not part of. (CVSS 2.2)
- [CVE-2024-9264](https://cve.now/CVE-2024-9264.md): Grafana SQL Expressions allow for remote code execution (CVSS 9.4)
- [CVE-2024-8118](https://cve.now/CVE-2024-8118.md): Grafana alerting wrong permission on datasource rule write endpoint (CVSS 5.1)
- [CVE-2024-8996](https://cve.now/CVE-2024-8996.md): Grafana Agent Flow on Windows Unquoted service path (CVSS 7.3)
- [CVE-2024-8975](https://cve.now/CVE-2024-8975.md): Grafana Alloy on Windows Unquoted service path (CVSS 7.3)
- [CVE-2024-6322](https://cve.now/CVE-2024-6322.md): Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account (CVSS 4.4)
- [CVE-2024-5526](https://cve.now/CVE-2024-5526.md): Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and inte (CVSS 7.7)
- [CVE-2024-1313](https://cve.now/CVE-2024-1313.md): Users outside an organization can delete a snapshot with its key (CVSS 6.5)
- [CVE-2024-1442](https://cve.now/CVE-2024-1442.md): User with permissions to create a data source can CRUD all data sources (CVSS 6.0)
- [CVE-2023-5122](https://cve.now/CVE-2023-5122.md): SSRF in CSV Datasource Plugin (CVSS 5.0)
- [CVE-2023-5123](https://cve.now/CVE-2023-5123.md): Improper Path Sanitization in JSON Datasource Plugin (CVSS 8.0)
- [CVE-2023-6152](https://cve.now/CVE-2023-6152.md): A user changing their email after signing up and verifying it can change it without verification in profile settings. (CVSS 5.4)
- [CVE-2023-3010](https://cve.now/CVE-2023-3010.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3)
- [CVE-2023-4399](https://cve.now/CVE-2023-4399.md): Grafana is an open-source platform for monitoring and observability. (CVSS 6.6)
- [CVE-2023-4457](https://cve.now/CVE-2023-4457.md): Grafana is an open-source platform for monitoring and observability. (CVSS 5.5)
- [CVE-2023-4822](https://cve.now/CVE-2023-4822.md): Grafana is an open-source platform for monitoring and observability. (CVSS 6.7)
- [CVE-2023-3128](https://cve.now/CVE-2023-3128.md): Grafana is validating Azure AD accounts based on the email claim. (CVSS 9.4)
- [CVE-2023-2183](https://cve.now/CVE-2023-2183.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.1)
- [CVE-2023-2801](https://cve.now/CVE-2023-2801.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.5)
- [CVE-2023-1387](https://cve.now/CVE-2023-1387.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.2)
- [CVE-2023-1410](https://cve.now/CVE-2023-1410.md): Stored XSS in Graphite FunctionDescription tooltip (CVSS 6.2)
- [CVE-2023-22462](https://cve.now/CVE-2023-22462.md): Stored XSS in Grafana Text plugin (CVSS 6.4)
- [CVE-2023-0594](https://cve.now/CVE-2023-0594.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3)
- [CVE-2023-0507](https://cve.now/CVE-2023-0507.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3)
- [CVE-2022-23498](https://cve.now/CVE-2022-23498.md): When query caching is enabled in Grafana users can query another users session (CVSS 7.1)
- [CVE-2022-23552](https://cve.now/CVE-2022-23552.md): Grafana stored XSS in FileUploader component (CVSS 7.3)
- [CVE-2022-39324](https://cve.now/CVE-2022-39324.md): Grafana vulnerable to spoofing originalUrl of snapshots (CVSS 6.7)
- [CVE-2022-46156](https://cve.now/CVE-2022-46156.md): Grafana's default installation of \`synthetic-monitoring-agent\` exposes sensitive information (CVSS 7.2)
- [CVE-2022-39307](https://cve.now/CVE-2022-39307.md): Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password (CVSS 6.7)
- [CVE-2022-39306](https://cve.now/CVE-2022-39306.md): Grafana contains Improper Input Validation (CVSS 6.4)
- [CVE-2022-39328](https://cve.now/CVE-2022-39328.md): Grafana vulnerable to race condition allowing privilege escalation (CVSS 9.8)
- [CVE-2022-39229](https://cve.now/CVE-2022-39229.md): Grafana users with email as a username can block other users from signing in (CVSS 4.3)
- [CVE-2022-39201](https://cve.now/CVE-2022-39201.md): Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVSS 6.8)
- [CVE-2022-31130](https://cve.now/CVE-2022-31130.md): Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVSS 4.9)
- [CVE-2022-31123](https://cve.now/CVE-2022-31123.md): Grafana plugin signature bypass vulnerability (CVSS 6.1)
- [CVE-2022-36062](https://cve.now/CVE-2022-36062.md): Grafana folders admin only permission privilege escalation (CVSS 7.6)
- [CVE-2022-35957](https://cve.now/CVE-2022-35957.md): Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin (CVSS 6.6)
- [CVE-2022-31176](https://cve.now/CVE-2022-31176.md): Grafana Image Renderer leaking files (CVSS 8.3)
- [CVE-2022-31107](https://cve.now/CVE-2022-31107.md): Grafana account takeover via OAuth vulnerability (CVSS 7.1)
- [CVE-2022-31097](https://cve.now/CVE-2022-31097.md): Stored XSS in Grafana's Unified Alerting (CVSS 7.3)
- [CVE-2022-29170](https://cve.now/CVE-2022-29170.md): Grafana Enterprise datasource network restrictions bypass via HTTP redirects (CVSS 6.6)
- [CVE-2022-24812](https://cve.now/CVE-2022-24812.md): FGAC API Key privilege escalation in Grafana (CVSS 8.0)
- [CVE-2022-21713](https://cve.now/CVE-2022-21713.md): Exposure of Sensitive Information in Grafana (CVSS 4.3)
- [CVE-2022-21703](https://cve.now/CVE-2022-21703.md): Cross Site Request Forgery in Grafana (CVSS 6.3)
- [CVE-2022-21702](https://cve.now/CVE-2022-21702.md): Cross site scripting in Grafana proxy (CVSS 6.5)
- [CVE-2022-21673](https://cve.now/CVE-2022-21673.md): OAuth Identity Token exposure in Grafana (CVSS 4.3)
- [CVE-2021-43815](https://cve.now/CVE-2021-43815.md): Grafana directory traversal for \`.cvs\` files (CVSS 4.3)
- [CVE-2021-43813](https://cve.now/CVE-2021-43813.md): Directory Traversal in Grafana (CVSS 4.3)
- [CVE-2021-41090](https://cve.now/CVE-2021-41090.md): Instance config inline secret exposure (CVSS 6.5)
- [CVE-2021-43798](https://cve.now/CVE-2021-43798.md): Grafana path traversal (CVSS 7.5, KEV)
- [CVE-2021-41244](https://cve.now/CVE-2021-41244.md): Cross organization admin control in Grafana (CVSS 9.1)
- [CVE-2021-41174](https://cve.now/CVE-2021-41174.md): XSS vulnerability allowing arbitrary JavaScript execution (CVSS 6.9)
- [CVE-2021-39226](https://cve.now/CVE-2021-39226.md): Snapshot authentication bypass in grafana (CVSS 9.8, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/grafana
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.