Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 167

Export CSV
CVE-2026-42127

Pre-authentication denial of service in the public dashboard query endpoint

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-9029

Stored XSS in the Geomap panel tile-layer attribution

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-33380

SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-33381

Users can generate Service Account tokens after permissions removal

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-28374

IDOR in Annotations API allows unprivileged users to DELETE annotation

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-28379

Viewer-triggered race condition in Grafana Live leads to complete server crash

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-28380

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Any Editor could delete any snapshot, even if they have no access to read or write them.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-28383

Grafana plugin resources can lead to unbounded memory allocation

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-33376

Auth Proxy IPv6 whitelist bypass

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-33377

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-33378

Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-28376

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-27880

OpenFeature evaluation API reads input data with no bounds

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-27877

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2025-4123

grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

CVSS 3.1 · 7.6 High EPSS 97.1% KEV · Not listed
Vendors
Grafana Redhat
Products
Grafana Enterprise Linux Rhel Aus and 3 more
CVE-2025-41115

Incorrect privilege assignment

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

CVSS 3.1 · 10 Critical EPSS 17.5% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2025-41117

XSS in Grafana Explore stack trace

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-21721

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana Grafana Enterprise
CVE-2026-33375

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2026-27879

Query resampling can cause unbounded memory allocations

A resample query can be used to trigger out-of-memory crashes in Grafana.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana