| CVE-2026-28375 | MEDIO6.5 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. | 27/03/2026 |
| CVE-2026-27880 | ALTO7.5 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. | 27/03/2026 |
| CVE-2026-27879 | MEDIO6.5 | A resample query can be used to trigger out-of-memory crashes in Grafana. | 27/03/2026 |
| CVE-2026-27877 | ALTO7.5 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' secur | 27/03/2026 |
| CVE-2026-27876 | CRÍTICO9.1 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.
Only instances with the sqlExpressions feature to | 27/03/2026 |
| CVE-2026-33375 | MEDIO6.5 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. | 26/03/2026 |
| CVE-2026-21724 | MEDIO4.3 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. | 26/03/2026 |
| CVE-2026-21725 | BAJO2.0 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions to be met:
- The attacker must have admin access to the specific datasource prior to its first deletion.
- Upon deletion, | 25/02/2026 |
| CVE-2026-21722 | MEDIO5.3 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.
This did not leak any annotations that would not o | 12/02/2026 |
| CVE-2025-41117 | MEDIO6.1 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.
Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected | 12/02/2026 |
| CVE-2026-21721 | ALTO8.1 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation. | 27/01/2026 |
| CVE-2026-21720 | ALTO7.5 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with | 27/01/2026 |
| CVE-2025-41115 | CRÍTICO9.8 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allo | 21/11/2025 |
| CVE-2025-4123 | MEDIO6.1 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous ac | 22/05/2025 |
| CVE-2024-10452 | BAJO2.7 | Organization admins can delete pending invites created in an organization they are not part of. | 29/10/2024 |
| CVE-2024-9264 | ALTO8.8 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is cap | 18/10/2024 |
| CVE-2024-1442 | ALTO8.8 | A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
| 07/03/2024 |
| CVE-2023-5122 | MEDIO5.3 | Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no p | 14/02/2024 |
| CVE-2023-6152 | MEDIO5.4 | A user changing their email after signing up and verifying it can change it without verification in profile settings.
The configuration option "verify_email_enabled" will only validate email only on sign up.
| 13/02/2024 |
| CVE-2023-4399 | ALTO7.2 | Grafana is an open-source platform for monitoring and observability.
In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.
However, the restriction can be bypassed used punycode encoding of the characters in the reque | 17/10/2023 |