CVE-2026-76154

CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Grafana Enterprise Hummingbird

CVE-2026-14199

Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-12704

SAML assertion replay via skipped InResponseTo validation

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Enterprise

CVE-2026-19475

SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Microsoft Sql Server Datasource Mysql Datasource and 1 more

CVE-2026-77849

grafana-global-hub: grafana-global-hub: Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`

No description is available for this CVE.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed

Vendors

Grafana

Products

Global Hub

CVE-2026-80221

grafana-global-hub: grafana-global-hub: Direct database connection string with embedded credentials passed as environment variable

No description is available for this CVE.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed

Vendors

Grafana

Products

Global Hub

CVE-2026-19197

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-19854

CVE-2026-19854 CVE Record

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Clickhouse Datasource

CVE-2026-75889

CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Alloy

CVE-2026-11817

CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-17033

CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-21727

Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Correlations

CVE-2026-17183

CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-72585

Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points

Red Hat CNA-LR concluded that this CVE is not valid.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-19516

CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Mcp Server

CVE-2026-15583

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Mcp Server

CVE-2026-21723

CVE-2026-21723 Record

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-9765

CVE-2026-9765 CVE Record

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-63087

Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Oncall

CVE-2026-28378

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise