Grafana vulnerabilities
141 CVEs and advisories name Grafana as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-39201Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
- CVE-2022-31130Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
- CVE-2022-31123Grafana plugin signature bypass vulnerability
- CVE-2022-36062Grafana folders admin only permission privilege escalation
- CVE-2022-35957Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
- CVE-2022-31176Grafana Image Renderer leaking files
- CVE-2022-31107Grafana account takeover via OAuth vulnerability
- CVE-2022-31097Stored XSS in Grafana's Unified Alerting
- CVE-2022-29170Grafana Enterprise datasource network restrictions bypass via HTTP redirects
- CVE-2022-24812FGAC API Key privilege escalation in Grafana
- CVE-2022-21713Exposure of Sensitive Information in Grafana
- CVE-2022-21703Cross Site Request Forgery in Grafana
- CVE-2022-21702Cross site scripting in Grafana proxy
- CVE-2022-21673OAuth Identity Token exposure in Grafana
- CVE-2021-43815Grafana directory traversal for `.cvs` files
- CVE-2021-43813Directory Traversal in Grafana
- CVE-2021-41090Instance config inline secret exposure
- CVE-2021-43798Grafana path traversal
- CVE-2021-41244Cross organization admin control in Grafana
- CVE-2021-41174XSS vulnerability allowing arbitrary JavaScript execution
- CVE-2021-39226Snapshot authentication bypass in grafana