| CVE-2026-28375 | 中危6.5 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. | 27/03/2026 |
| CVE-2026-27880 | 高危7.5 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. | 27/03/2026 |
| CVE-2026-27879 | 中危6.5 | A resample query can be used to trigger out-of-memory crashes in Grafana. | 27/03/2026 |
| CVE-2026-27877 | 高危7.5 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' secur | 27/03/2026 |
| CVE-2026-27876 | 严重9.1 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path.
Only instances with the sqlExpressions feature to | 27/03/2026 |
| CVE-2026-33375 | 中危6.5 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. | 26/03/2026 |
| CVE-2026-21724 | 中危4.3 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. | 26/03/2026 |
| CVE-2026-21725 | 低危2.0 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.
This requires several very stringent conditions to be met:
- The attacker must have admin access to the specific datasource prior to its first deletion.
- Upon deletion, | 25/02/2026 |
| CVE-2026-21722 | 中危5.3 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.
This did not leak any annotations that would not o | 12/02/2026 |
| CVE-2025-41117 | 中危6.1 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.
Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected | 12/02/2026 |
| CVE-2026-21721 | 高危8.1 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation. | 27/01/2026 |
| CVE-2026-21720 | 高危7.5 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with | 27/01/2026 |
| CVE-2025-41115 | 严重9.8 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allo | 21/11/2025 |
| CVE-2025-4123 | 中危6.1 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous ac | 22/05/2025 |
| CVE-2024-10452 | 低危2.7 | Organization admins can delete pending invites created in an organization they are not part of. | 29/10/2024 |
| CVE-2024-9264 | 高危8.8 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is cap | 18/10/2024 |
| CVE-2024-1442 | 高危8.8 | A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
| 07/03/2024 |
| CVE-2023-5122 | 中危5.3 | Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no p | 14/02/2024 |
| CVE-2023-6152 | 中危5.4 | A user changing their email after signing up and verifying it can change it without verification in profile settings.
The configuration option "verify_email_enabled" will only validate email only on sign up.
| 13/02/2024 |
| CVE-2023-4399 | 高危7.2 | Grafana is an open-source platform for monitoring and observability.
In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.
However, the restriction can be bypassed used punycode encoding of the characters in the reque | 17/10/2023 |