Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
191 results · page 2 of 4
May 13, 2026An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.CVE-2026-33377 · Other software · Grafana · reported by security@grafana.comHigh 7.1
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.CVE-2026-33376 · Other software · Grafana · reported by security@grafana.comHigh 7.4
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory.CVE-2026-28383 · Other software · Grafana · reported by security@grafana.comMedium 6.5
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-28380 · Other software · Grafana · reported by security@grafana.comMedium 6.5
Any Editor could delete any snapshot, even if they have no access to read or write them.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map accCVE-2026-28379 · Other software · Grafana · reported by security@grafana.comMedium 6.5
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-ofCVE-2026-28376 · Other software · Grafana · reported by security@grafana.comMedium 6.5
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Editors could delete any annotation, even those they do not have read access to.CVE-2026-28374 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.CVE-2026-21728 · Other software · Grafana · reported by security@grafana.comHigh 7.5
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.
- Product
- Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Apr 15, 2026A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records.CVE-2026-21727 · Other software · Grafana · reported by security@grafana.comLow 3.3
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4. Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.
- Product
- Grafana Correlations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files CVE-2026-21726 · Other software · Grafana · reported by security@grafana.comMedium 5.3
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.
- Product
- Loki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Pyroscope is an open-source continuous profiling database.CVE-2025-41118 · Other software · Grafana · reported by security@grafana.comCritical 9.1
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems. This vulnerability is fixed in versions: 1.15.x: 1.15.2 and above. 1.16.x: 1.16.1 and above. 1.17.x: 1.17.0 and above (i.e. all versions). Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
- Product
- Pyroscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Apr 15, 2026In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.CVE-2025-12141 · Other software · Grafana · reported by security@grafana.comLow 1.3
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
- Product
- Grafana Alerting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-28375 · Other software · Grafana · reported by security@grafana.comMedium 6.5
A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.CVE-2026-27880 · Other software · Grafana · reported by security@grafana.comHigh 7.5
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Mar 27, 2026A resample query can be used to trigger out-of-memory crashes in Grafana.CVE-2026-27879 · Other software · Grafana · reported by security@grafana.comMedium 6.5
A resample query can be used to trigger out-of-memory crashes in Grafana.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.CVE-2026-27877 · Other software · Grafana · reported by security@grafana.comMedium 6.5
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Mar 27, 2026A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE).CVE-2026-27876 · Other software · Grafana · reported by security@grafana.comCritical 9.1
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Mar 26, 2026A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users tCVE-2026-28377 · Other software · Grafana · reported by security@grafana.comHigh 7.5
A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.
- Product
- Tempo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-CVE-2026-33375 · Other software · Grafana · reported by security@grafana.comMedium 6.5
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify CVE-2026-21724 · Other software · Grafana · reported by security@grafana.comMedium 5.4
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026The grafanacubism-panel plugin allows use of cubism.js in Grafana.CVE-2026-32117 · Other software · ekacnet · reported by GitHubHigh 7.6
The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.
- Product
- grafanacubism-panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.CVE-2026-21725 · Other software · Grafana · reported by security@grafana.comLow 2.6
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard.CVE-2026-21722 · Other software · Grafana · reported by security@grafana.comMedium 5.3
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser.CVE-2025-41117 · Other software · Grafana · reported by security@grafana.comMedium 6.8
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action.CVE-2026-21721 · Other software · Grafana · reported by security@grafana.comHigh 8.1
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Jan 27, 2026Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image.CVE-2026-21720 · Other software · Grafana · reported by security@grafana.comHigh 7.5
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
- Product
- grafana/grafana-enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Nov 21, 2025SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing CVE-2025-41115 · Other software · Grafana · reported by security@grafana.comCritical 10
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the CVE-2025-41116 · Other software · Grafana Labs · reported by security@grafana.comLow 2.1
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
- Product
- Grafana Databricks Datasource Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the sCVE-2025-3717 · Other software · Grafana Labs · reported by security@grafana.comLow 2.1
When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
- Product
- Grafana Snowflake Datasource Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability.CVE-2025-11539 · Other software · Grafana · reported by security@grafana.comCritical 9.9
Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16.
- Product
- grafana-image-renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-10630 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.
- Product
- grafana-zabbix-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus.CVE-2025-58746 · Other software · VolkovLabs · reported by GitHubCritical 9
The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary administrative actions. This is possible because the plugin allows arbitrary JavaScript code injection in the [Layout] → [Link] → [URL] field. Version 2.4.0 contains a fix for the issue.
- Product
- business-links
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-8341 · Other software · Grafana · reported by security@grafana.comMedium 5
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
- Product
- grafana-infinity-datasource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.CVE-2025-6197 · Other software · Grafana · reported by security@grafana.comMedium 4.2
An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comgrafana.com
Jul 18, 2025An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.CVE-2025-6023 · Other software · Grafana · reported by security@grafana.comHigh 7.6
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comgrafana.com
Jul 17, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-3415 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerabilityCVE-2025-1088 · Other software · Grafana · reported by security@grafana.comLow 2.7
In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.CVE-2025-3454 · Other software · Grafana · reported by security@grafana.comMedium 5
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions.CVE-2025-3260 · Other software · Grafana · reported by security@grafana.comHigh 8.3
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account.CVE-2025-3580 · Other software · Grafana · reported by security@grafana.comMedium 5.5
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.CVE-2025-4123 · Other software · Grafana · reported by security@grafana.comHigh 7.6
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comgrafana.com
Apr 23, 2025The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.CVE-2025-2703 · Other software · Grafana · reported by security@grafana.comMedium 6.8
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsonarsource.com
Jan 31, 2025Grafana is an open-source platform for monitoring and observability.CVE-2024-11741 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
Nov 13, 2024A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within CVE-2024-9476 · Other software · Grafana Labs · reported by security@grafana.comMedium 5.1
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
- Product
- Grafana OSS and Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comgrafana.com
Oct 29, 2024Organization admins can delete pending invites created in an organization they are not part of.CVE-2024-10452 · Other software · Grafana · reported by security@grafana.comLow 2.2
Organization admins can delete pending invites created in an organization they are not part of.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.CVE-2024-9264 · Other software · Grafana · reported by security@grafana.comCritical 9.4
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
Sep 26, 2024In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also writeCVE-2024-8118 · Other software · Grafana · reported by security@grafana.comMedium 5.1
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects ACVE-2024-8996 · Other software · Grafana · reported by security@grafana.comHigh 7.3
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2
- Product
- Agent Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: beforeCVE-2024-8975 · Other software · Grafana · reported by security@grafana.comHigh 7.3
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.
- Product
- Alloy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved CVE-2024-8986 · Other software · grafana-plugin-sdk-go · reported by security@grafana.comCritical 9.1
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
- Product
- Grafana Plugin SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.