Grafana vulnerabilities
141 CVEs and advisories name Grafana as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-19516CVE-2026-19516 CVE Record
- CVE-2026-9765CVE-2026-9765 CVE Record
- CVE-2026-21723CVE-2026-21723 Record
- CVE-2026-21729Loki detected_fields query limits results in unbounded memory allocation
- CVE-2026-15583SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
- CVE-2026-8595Stored XSS in the table panel (TableNG)
- CVE-2026-8609Pre-authentication denial of service via the OAuth login route
- CVE-2026-33382Denial of service via unbounded request body size
- CVE-2026-28378Cross-Organization Public Dashboard Deletion via Missing Org Isolation
- CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpoint
- CVE-2026-28381Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
- CVE-2026-9029Stored XSS in the Geomap panel tile-layer attribution
- CVE-2026-10601Path traversal in the Tempo and Loki data source plugins
- CVE-2026-42129Path traversal in the Loki data source plugin
- CVE-2026-27878Tempo TraceQL query with exemplar hint could result in unbounded memory usage
- CVE-2026-11769Operator - Namespaced User Path Traversal
- CVE-2026-28374IDOR in Annotations API allows unprivileged users to DELETE annotation
- CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
- CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocation
- CVE-2026-33376Auth Proxy IPv6 whitelist bypass
- CVE-2026-33380SQL Expressions Read File From Disk
- CVE-2026-28380BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
- CVE-2026-33381Users can generate Service Account tokens after permissions removal
- CVE-2026-33377Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
- CVE-2026-28376Grafana Live push endpoint allows unbounded memory allocation leading to OOM
- CVE-2026-28379Viewer-triggered race condition in Grafana Live leads to complete server crash
- CVE-2026-21728Tempo query limit results in unbounded memory allocation
- CVE-2026-21726Loki Path Traversal - CVE-2021-36156 Bypass
- CVE-2025-41118Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
- CVE-2026-21727Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record