[ Vendor · 13 CVEs ]
Grafana
CVEs affecting Grafana published in the last 30 days, plus any Grafana CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-92539 | 20 Oct 2026 | CVSS 6.7 | Grafana EnterpriseA service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on… | |
| CVE-2026-9703 | 15 Oct 2026 | CVSS 7.1 | Grafana EnterpriseGrafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer… | |
| CVE-2026-93294 | 13 Oct 2026 | CVSS 6.3 | Grafana EnterpriseA user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs… | |
| CVE-2026-95502 | 13 Oct 2026 | CVSS 5.3 | Grafana NanogitA Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed… | |
| CVE-2026-15577 | 13 Oct 2026 | CVSS 6.5 | Grafana EnterpriseA user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status… | |
| CVE-2026-33374 | 13 Oct 2026 | CVSS 6.5 | Grafana EnterpriseThe Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory… | |
| CVE-2026-89039 | 5 Oct 2026 | CVSS 6.5 | Grafana mcp-k6A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the… | |
| CVE-2026-13719 | 30 Sep 2026 | CVSS 4.3 | Grafana EnterpriseAn authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of… | |
| CVE-2026-13720 | 30 Sep 2026 | CVSS 5.4 | Grafana OSSAn Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating… | |
| CVE-2026-81841 | 29 Sep 2026 | CVSS 5.3 | Grafana EnterprisePausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to… | |
| CVE-2026-81842 | 29 Sep 2026 | CVSS 4.3 | Grafana EnterpriseAn authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through… | |
| CVE-2021-43798 | 7 Dec 2021 | CVSS 7.5 | Grafana Path TraversalGrafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss… | ExploitedFix |
| CVE-2021-39226 | 5 Oct 2021 | CVSS 7.3 | Grafana Authentication BypassGrafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot… | ExploitedFix |