Grafana vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Grafana flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-43798 Grafana Path TraversalExploited since Oct 9, 2025 · CVSS 7.5
• CVE-2021-39226 Grafana Authentication BypassExploited since Aug 25, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-88967 A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data souHigh 7.7 · Oct 28, 2026
• CVE-2026-103506 An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization).High 8.9 · Oct 28, 2026
• CVE-2026-100105 A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switchHigh 7.7 · Oct 28, 2026
• CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.High 7.1 · Oct 15, 2026
• CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in anotHigh 7.3 · Sep 17, 2026
• CVE-2026-15815 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.High 8.8 · Sep 17, 2026
• CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.High 7.1 · Sep 2, 2026
• CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify High 7.7 · Aug 27, 2026
• CVE-2026-17183 An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side exHigh 7.1 · Aug 19, 2026
• CVE-2026-19516 A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller alsCritical 9.1 · Aug 11, 2026
• CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.High 7.1 · Jul 24, 2026
• CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.High 7.5 · Jul 16, 2026
• CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-accountHigh 8.6 · Jul 15, 2026
• CVE-2026-33382 Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it.High 7.5 · Jul 10, 2026
• CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocatioHigh 7.5 · Jun 22, 2026
• CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable.High 7.3 · Jun 22, 2026
• CVE-2026-42129 A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuHigh 7.7 · Jun 22, 2026
• CVE-2026-28381 The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between thCritical 9.6 · Jun 22, 2026
• CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.High 7.1 · May 13, 2026
• CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.High 7.4 · May 13, 2026
• CVE-2026-21728 Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.High 7.5 · Apr 24, 2026
• CVE-2025-41118 Pyroscope is an open-source continuous profiling database.Critical 9.1 · Apr 15, 2026
• CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.High 7.5 · Mar 27, 2026
• CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE).Critical 9.1 · Mar 27, 2026
• CVE-2026-28377 A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users tHigh 7.5 · Mar 26, 2026