Advisories · Technology
Grafana OSS.
Every CVE that names Grafana OSS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.0 Medium
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
- Grafana OSS
- Grafana Enterprise
- Information disclosure
- CVSS 8.9 High
SSO settings authorization bypass
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 6.5 Medium
Server-side expression parser denial of service
- Grafana OSS
- Grafana Enterprise
- Denial of service
- CWE-20
- CVSS 7.7 High
Azure Monitor access token disclosure via SSRF
- Grafana Enterprise
- Grafana OSS
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Alerting contact point authorization bypass via schema downgrade
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 6.5 Medium
CVE-2026-16491 CVE Record
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 7.1 High
Viewer role can create, modify and delete Loki alerting rules
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 6.5 Medium
Unbounded memory allocation in the Prometheus rule conversion API
- Grafana Enterprise
- Grafana OSS
- Denial of service
- CVSS 6.5 Medium
Git Sync connection configuration can be modified with read-only access
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 6.3 Medium
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CWE-441
- CVSS 5.3 Medium
Git Sync memory exhaustion via a malicious Git server
- Grafana Nanogit
- Grafana OSS
- Denial of service
- CWE-409
- CVSS 5.4 Medium
Editor can forge file-provisioning provenance on dashboards via the dashboard API
- Grafana OSS
- Grafana Enterprise
- Broken access control
- CWE-345
- CVSS 4.3 Medium
Alert rules in restricted folders disclosed via the alert rules list API
- Grafana Enterprise
- Grafana OSS
- Information disclosure
- Broken access control
- CVSS 4.3 Medium
Library panel can be moved into a folder without library panel create permission
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 5.3 Medium
Paused shared dashboard access tokens still expose data source configuration
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 8.8 High
CVE-2026-15815 CVE Record
- Grafana OSS
- Grafana Enterprise
- Path traversal
- Code injection
- CVSS 7.3 High
CVE-2026-76154 CVE Record
- Grafana OSS
- Grafana Enterprise
- Cross-site scripting (XSS)
- CVSS 7.1 High
Session takeover via Auth Proxy cache key collision
- Grafana Enterprise
- Grafana OSS
- Authentication bypass
- Broken access control
- CVSS 6.5 Medium
SQL Data Source Plugin: OOM DoS via $__timeGroup macro
- Grafana PostgreSQL Datasource
- Grafana MySQL Datasource
- Denial of service
- CVSS 6.3 Medium
Broken access control in dashboard snapshots
- Grafana OSS
- Grafana Enterprise
- Broken access control
- CVSS 6.8 Medium
CVE-2026-17033 CVE Record
- Grafana OSS
- Cross-site scripting (XSS)
- CVSS 7.1 High
CVE-2026-17183 CVE Record
- Grafana OSS
- Grafana Enterprise
- Broken access control
- CVSS 5.3 Medium
CVE-2026-11817 CVE Record
- Grafana OSS
- Grafana Enterprise
- Broken access control
- CVSS 5.3 Medium
CVE-2026-21723 Record
- Grafana OSS
- Denial of service
- CVSS 6.8 Medium
Stored XSS in the table panel (TableNG)
- Grafana OSS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Pre-authentication denial of service via the OAuth login route
- Grafana OSS
- Denial of service
- CVSS 7.5 High
Denial of service via unbounded request body size
- Grafana OSS
- Denial of service
- CVSS 3.1 Low
Cross-Organization Public Dashboard Deletion via Missing Org Isolation
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 4.3 Medium
IDOR in Annotations API allows unprivileged users to DELETE annotation
- Grafana OSS
- Broken access control
- CVSS 6.5 Medium
Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
- Grafana OSS
- Denial of service
- CVSS 6.5 Medium
Grafana plugin resources can lead to unbounded memory allocation
- Grafana OSS
- Denial of service
- CVSS 7.4 High
Auth Proxy IPv6 whitelist bypass
- Grafana OSS
- CWE-1188
- CVSS 6.5 Medium
BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
- Grafana OSS
- Broken access control
- CVSS 7.1 High
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
- Grafana OSS
- Broken access control
- CVSS 6.5 Medium
Grafana Live push endpoint allows unbounded memory allocation leading to OOM
- Grafana OSS
- Denial of service
- CVSS 6.5 Medium
Viewer-triggered race condition in Grafana Live leads to complete server crash
- Grafana OSS
- Race condition
- CVSS 6.5 Medium
Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
- Grafana OSS
- Denial of service