Grafana vulnerabilities
141 CVEs and advisories name Grafana as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-12141Grafana Alerting Editors can edit destination of webhooks they did not create
- CVE-2026-27879Query resampling can cause unbounded memory allocations
- CVE-2026-28375Grafana Testdata datasource can issue unbounded memory allocations
- CVE-2026-27876RCE on Grafana via sqlExpressions
- CVE-2026-27880OpenFeature evaluation API reads input data with no bounds
- CVE-2026-27877Public dashboards discloses all direct mode datasources
- CVE-2026-28377S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)
- CVE-2026-21724Missing Protected-field Authorization in Provisioning Contact Points API
- CVE-2026-33375Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
- CVE-2026-21725Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
- CVE-2025-41117XSS in Grafana Explore stack trace
- CVE-2026-21722Public Dashboards time range restriction on annotations can be bypassed
- CVE-2026-21721Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
- CVE-2026-21720Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
- CVE-2025-41115Incorrect privilege assignment
- CVE-2025-11539Arbitrary Code Execution in Grafana Image Renderer Plugin
- CVE-2025-10630Regex DoS in Grafana Zabbix Plugin
- CVE-2025-8341SSRF in Infinity Datasource Plugin
- CVE-2025-6197An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.
- CVE-2025-6023An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.
- CVE-2025-3415Grafana is an open-source platform for monitoring and observability.
- CVE-2025-1088Very long unicode dashboard title or panel name can hang the frontend
- CVE-2025-3454This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the UR
- CVE-2025-3260A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder…
- CVE-2025-3580An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server admini
- CVE-2025-4123A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.
- CVE-2025-2703The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.
- CVE-2024-11741Grafana is an open-source platform for monitoring and observability.
- CVE-2024-10452Organization admins can delete pending invites created in an organization they are not part of.
- CVE-2024-9264Grafana SQL Expressions allow for remote code execution