Refine your search
117 vulnerabilities found for by Grafana
CVE-2026-75889 (GCVE-0-2026-75889)
Vulnerability from cvelistv5
Published
2026-08-27 17:22
Modified
2026-08-28 16:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75889",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T13:58:25.670440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552 Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:55:05.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Alloy",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "1.18.1",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Trung Nguyen (@everping) of CyStack"
}
],
"datePublic": "2026-08-18T13:48:18.251Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana Alloy\u2019s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy\u2019s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy\u2019s service account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:38.284Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-75889"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "CVE-2026-75889 CVE Record"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-75889",
"datePublished": "2026-08-27T17:22:22.328Z",
"dateReserved": "2026-08-18T13:48:17.836Z",
"dateUpdated": "2026-08-28T16:55:05.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19854 (GCVE-0-2026-19854)
Vulnerability from cvelistv5
Published
2026-08-27 16:35
Modified
2026-08-27 17:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-319 - :Cleartext Transmission of Sensitive Information
Summary
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Clickhouse Datasource |
Version: 3.1.0 ≤ 4.20.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T17:44:17.382715Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:44:26.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Clickhouse Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "4.20.0",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-14T19:31:00.354Z",
"descriptions": [
{
"lang": "en",
"value": "When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319:Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:20.420Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-19854"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "CVE-2026-19854 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-19854",
"datePublished": "2026-08-27T16:35:17.652Z",
"dateReserved": "2026-08-14T09:38:53.631Z",
"dateUpdated": "2026-08-27T17:44:26.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19197 (GCVE-0-2026-19197)
Vulnerability from cvelistv5
Published
2026-08-26 08:50
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 12.4.0 ≤ Version: 13.0.0 ≤ Version: 13.1.0 ≤ |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:42:34.663264Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:48:49.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.8",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.6",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.3",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.8",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.6",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.3",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Snyk"
}
],
"datePublic": "2026-08-06T20:25:59.097Z",
"descriptions": [
{
"lang": "en",
"value": "A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot\u0027s secret delete key using only its public share key (broken access control)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:36.904Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-19197"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Broken access control in dashboard snapshots",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-19197",
"datePublished": "2026-08-26T08:50:27.854Z",
"dateReserved": "2026-08-06T20:25:58.163Z",
"dateUpdated": "2026-08-27T17:22:36.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17033 (GCVE-0-2026-17033)
Vulnerability from cvelistv5
Published
2026-08-24 13:52
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING')
Summary
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 0 ≤ 12.3.11 Version: 12.4.0 ≤ 12.4.9 Version: 13.0.0 ≤ 13.0.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T15:10:56.482893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T15:11:08.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.9",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.7",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nlgbao1340"
}
],
"datePublic": "2026-08-24T12:11:43.533Z",
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user\u0027s Grafana session.\n\nGrafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor\u0027s :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user\u0027s permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (\u0027CROSS-SITE SCRIPTING\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:43.827Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-17033"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "CVE-2026-17033 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-17033",
"datePublished": "2026-08-24T13:52:26.910Z",
"dateReserved": "2026-07-24T12:11:43.417Z",
"dateUpdated": "2026-08-27T17:22:43.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17183 (GCVE-0-2026-17183)
Vulnerability from cvelistv5
Published
2026-08-19 17:30
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - INCORRECT AUTHORIZATION
Summary
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 8.4.0 ≤ Version: 12.4.0 ≤ Version: 13.0.0 ≤ Version: 13.1.0 ≤ |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17183",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:40:28.206524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:42:03.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.3.11",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.9",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.7",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.4",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.3.11",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.9",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.7",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.4",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "czarflix"
}
],
"datePublic": "2026-07-24T18:38:02.945Z",
"descriptions": [
{
"lang": "en",
"value": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: INCORRECT AUTHORIZATION",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:31.524Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-17183"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "CVE-2026-17183 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-17183",
"datePublished": "2026-08-19T17:30:06.798Z",
"dateReserved": "2026-07-24T18:38:02.221Z",
"dateUpdated": "2026-08-27T17:22:31.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11817 (GCVE-0-2026-11817)
Vulnerability from cvelistv5
Published
2026-08-17 21:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 12.4.0 ≤ 12.4.5 Version: 11.2.0 ≤ 11.6.16 Version: 13.0.0 ≤ 13.0.3 Version: 13.1.0 ≤ 13.1.0 Version: 12.2.0 ≤ 12.2.10 Version: 12.3.0 ≤ 12.3.8 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11817",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T15:22:39.226844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:22:45.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.0",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.0",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-07-17T14:01:45.422Z",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:21.151Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-11817"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "CVE-2026-11817 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-11817",
"datePublished": "2026-08-17T21:28:17.497Z",
"dateReserved": "2026-06-09T16:24:38.153Z",
"dateUpdated": "2026-08-27T17:22:21.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19516 (GCVE-0-2026-19516)
Vulnerability from cvelistv5
Published
2026-08-11 05:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana MCP Server |
Version: 0.0.0 ≤ 1.0.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:05:21.230758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:05:49.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana MCP Server",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mcp-grafana",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "foguel (Researcher)"
}
],
"datePublic": "2026-08-11T05:23:27.801Z",
"descriptions": [
{
"lang": "en",
"value": "A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana\u0027s outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:24.258Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-19516"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "CVE-2026-19516 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-19516",
"datePublished": "2026-08-11T05:28:30.662Z",
"dateReserved": "2026-08-11T05:23:23.935Z",
"dateUpdated": "2026-08-27T17:22:24.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9765 (GCVE-0-2026-9765)
Vulnerability from cvelistv5
Published
2026-07-24 12:23
Modified
2026-07-24 14:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.
Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions.
Broken access control can allow attackers to:
Access resources only accessible to certain users, thus allowing unauthorized access to data
Perform operations on behalf of other users, leading to account takeovers in the worst cases
Attempt privilege escalation
Attempt to take over an account
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana IRM |
Version: 1.0.0 ≤ 1.164.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:47:15.168863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:47:18.667Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana IRM",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "1.164.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-06-27T20:25:07.981Z",
"descriptions": [
{
"lang": "en",
"value": "Note: The CVE and blog post don\u0027t exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T12:23:14.114Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-9765"
}
],
"source": {
"discovery": "PEN_TEST"
},
"title": "CVE-2026-9765 CVE Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-9765",
"datePublished": "2026-07-24T12:23:14.114Z",
"dateReserved": "2026-05-27T19:51:51.271Z",
"dateUpdated": "2026-07-24T14:47:18.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21723 (GCVE-0-2026-21723)
Vulnerability from cvelistv5
Published
2026-07-23 01:48
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 8.0.0 ≤ 11.0.0 Version: 11.0.0 ≤ 11.6.10 Version: 12.0.0 ≤ 12.0.9 Version: 12.1.0 ≤ 12.1.6 Version: 12.2.0 ≤ 12.2.4 Version: 12.3.0 ≤ 12.3.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T14:15:50.650728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T14:16:10.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.0.0",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.10",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.9",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.6",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.4",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.2",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nacl (Researcher)"
}
],
"datePublic": "2026-07-22T01:42:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:29.672Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-21723"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "CVE-2026-21723 Record",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-21723",
"datePublished": "2026-07-23T01:48:16.245Z",
"dateReserved": "2026-01-05T09:26:06.214Z",
"dateUpdated": "2026-08-27T17:22:29.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21729 (GCVE-0-2026-21729)
Vulnerability from cvelistv5
Published
2026-07-16 03:12
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21729",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T12:45:38.984777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T12:54:28.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"OnPrem",
"Cloud"
],
"product": "Loki",
"vendor": "Grafana",
"versions": [
{
"lessThan": "v3.7.0",
"status": "affected",
"version": "v3.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-02-23T07:50:28.948Z",
"descriptions": [
{
"lang": "en",
"value": "Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:35.582Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-21729"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Loki detected_fields query limits results in unbounded memory allocation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-21729",
"datePublished": "2026-07-16T03:12:07.912Z",
"dateReserved": "2026-01-05T09:26:06.215Z",
"dateUpdated": "2026-08-27T17:22:35.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15583 (GCVE-0-2026-15583)
Vulnerability from cvelistv5
Published
2026-07-15 07:29
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana MCP Server |
Version: 0.0.0 ≤ 0.17.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T14:45:45.760884Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-610",
"description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T14:46:09.050Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana MCP Server",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "0.17.1",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "cybersec42"
}
],
"datePublic": "2026-07-15T07:22:44.434Z",
"descriptions": [
{
"lang": "en",
"value": "A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server\u0027s environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:28.994Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-15583"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-15583",
"datePublished": "2026-07-15T07:29:48.038Z",
"dateReserved": "2026-07-13T11:27:32.132Z",
"dateUpdated": "2026-08-27T17:22:28.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8595 (GCVE-0-2026-8595)
Vulnerability from cvelistv5
Published
2026-07-10 14:59
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T15:59:08.422134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T15:59:19.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "avamost369 (Researcher)"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:45.998Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-8595"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Stored XSS in the table panel (TableNG)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-8595",
"datePublished": "2026-07-10T14:59:35.891Z",
"dateReserved": "2026-05-14T12:50:43.291Z",
"dateUpdated": "2026-08-27T17:22:45.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8609 (GCVE-0-2026-8609)
Vulnerability from cvelistv5
Published
2026-07-10 14:58
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 11.6.0 ≤ 11.6.14 Version: 12.2.0 ≤ 12.2.8 Version: 12.3.0 ≤ 12.3.6 Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T15:53:40.169487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T15:53:51.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "cyberjoker (Researcher)"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:37.575Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-8609"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Pre-authentication denial of service via the OAuth login route",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-8609",
"datePublished": "2026-07-10T14:58:33.522Z",
"dateReserved": "2026-05-14T16:01:42.297Z",
"dateUpdated": "2026-08-27T17:22:37.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33382 (GCVE-0-2026-33382)
Vulnerability from cvelistv5
Published
2026-07-10 14:58
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 11.6.0 ≤ 11.6.14 Version: 12.2.0 ≤ 12.2.8 Version: 12.3.0 ≤ 12.3.6 Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T15:59:38.846803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T15:59:43.742Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:28.355Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33382"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Denial of service via unbounded request body size",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33382",
"datePublished": "2026-07-10T14:58:23.329Z",
"dateReserved": "2026-03-19T07:55:06.978Z",
"dateUpdated": "2026-08-27T17:22:28.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28378 (GCVE-0-2026-28378)
Vulnerability from cvelistv5
Published
2026-07-07 21:08
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana Enterprise |
Version: 11.6.0 ≤ 11.6.13 Version: 12.1.0 ≤ 12.1.9 Version: 12.2.0 ≤ 12.2.7 Version: 12.3.0 ≤ 12.3.5 Version: 12.4.0 ≤ 12.4.1 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T13:50:28.034051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:38:39.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.13",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.9",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.7",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.5",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.1",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.13",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.9",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.7",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.5",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.1",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "rpgsec (Researcher)"
}
],
"datePublic": "2026-03-24T15:50:26.000Z",
"descriptions": [
{
"lang": "en",
"value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard\u0027s identifiers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:38.899Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-28378"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-28378",
"datePublished": "2026-07-07T21:08:04.579Z",
"dateReserved": "2026-02-27T07:16:12.218Z",
"dateUpdated": "2026-08-27T17:22:38.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42127 (GCVE-0-2026-42127)
Vulnerability from cvelistv5
Published
2026-06-22 16:31
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana Enterprise |
Version: 11.6.0 ≤ 11.6.14 Version: 12.2.0 ≤ 12.2.8 Version: 12.3.0 ≤ 12.3.6 Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T17:28:16.184877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:28:35.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Charlie Lewis"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:36.246Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-42127"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Pre-authentication denial of service in the public dashboard query endpoint",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-42127",
"datePublished": "2026-06-22T16:31:28.096Z",
"dateReserved": "2026-04-24T15:38:08.066Z",
"dateUpdated": "2026-08-27T17:22:36.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28381 (GCVE-0-2026-28381)
Vulnerability from cvelistv5
Published
2026-06-22 13:20
Modified
2026-06-24 15:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Snowflake Datasource |
Version: 1.14.7 ≤ 1.14.12 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T15:43:02.758856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:58:25.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Snowflake Datasource",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "1.14.12",
"status": "affected",
"version": "1.14.7",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stargravy (Researcher)"
}
],
"datePublic": "2026-05-15T17:00:39.039Z",
"descriptions": [
{
"lang": "en",
"value": "The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T13:20:29.440Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-28381"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-28381",
"datePublished": "2026-06-22T13:20:29.440Z",
"dateReserved": "2026-02-27T07:16:12.218Z",
"dateUpdated": "2026-06-24T15:58:25.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9029 (GCVE-0-2026-9029)
Vulnerability from cvelistv5
Published
2026-06-22 13:18
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T03:55:45.644989Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:55:58.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "trailerb18 (Researcher)"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel\u0027s XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:27.685Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-9029"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Stored XSS in the Geomap panel tile-layer attribution",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-9029",
"datePublished": "2026-06-22T13:18:40.770Z",
"dateReserved": "2026-05-19T15:28:45.662Z",
"dateUpdated": "2026-08-27T17:22:27.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10601 (GCVE-0-2026-10601)
Vulnerability from cvelistv5
Published
2026-06-22 13:18
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 11.6.0 ≤ 11.6.14 Version: 12.2.0 ≤ 12.2.8 Version: 12.3.0 ≤ 12.3.6 Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T15:44:03.006985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:54:19.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "homb (Researcher)"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:42.795Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-10601"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Path traversal in the Tempo and Loki data source plugins",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-10601",
"datePublished": "2026-06-22T13:18:31.531Z",
"dateReserved": "2026-06-02T09:57:26.570Z",
"dateUpdated": "2026-08-27T17:22:42.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42129 (GCVE-0-2026-42129)
Vulnerability from cvelistv5
Published
2026-06-22 13:18
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 11.6.0 ≤ 11.6.14 Version: 12.2.0 ≤ 12.2.8 Version: 12.3.0 ≤ 12.3.6 Version: 12.4.0 ≤ 12.4.3 Version: 13.0.0 ≤ 13.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T15:44:32.401117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:56:38.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "khanmarshal (Researcher)"
}
],
"datePublic": "2026-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:32.860Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-42129"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Path traversal in the Loki data source plugin",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-42129",
"datePublished": "2026-06-22T13:18:27.365Z",
"dateReserved": "2026-04-24T15:38:08.067Z",
"dateUpdated": "2026-08-27T17:22:32.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27878 (GCVE-0-2026-27878)
Vulnerability from cvelistv5
Published
2026-06-19 19:02
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Enterprise Traces (GET) |
Version: 2.6.1 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27878",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T17:09:51.414285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T12:14:04.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enterprise Traces (GET)",
"vendor": "Grafana",
"versions": [
{
"lessThan": "2.8.8",
"status": "affected",
"version": "2.6.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tempo",
"vendor": "Grafana",
"versions": [
{
"lessThan": "2.10.2",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-03-23T19:28:24.658Z",
"descriptions": [
{
"lang": "en",
"value": "A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:34.267Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-27878"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Tempo TraceQL query with exemplar hint could result in unbounded memory usage",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-27878",
"datePublished": "2026-06-19T19:02:27.028Z",
"dateReserved": "2026-02-24T14:30:17.726Z",
"dateUpdated": "2026-08-27T17:22:34.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11769 (GCVE-0-2026-11769)
Vulnerability from cvelistv5
Published
2026-06-13 04:17
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.
### Summary
The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.
### Impact
It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
### Affected versions
All Grafana Operator versions <= 5.23
### Solutions and mitigations
All installations should be upgraded as soon as possible.
As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "prevent-jsonnet-dashboards"
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups: ["grafana.integreatly.org"]
apiVersions: ["v1beta1"]
operations: ["CREATE", "UPDATE"]
resources: ["grafanadashboards", "grafanalibrarypanels"]
validations:
- expression: "!has(object.spec.jsonnetLib)"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "prevent-jsonnet-dashboards-clusterwide"
spec:
policyName: "prevent-jsonnet-dashboards"
validationActions: [Deny]
### Acknowledgement
We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana Operator |
Version: 0 ≤ 5.23.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T17:24:16.248300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T12:01:19.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Operator",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "5.23.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "cherez0ff"
}
],
"datePublic": "2026-07-09T11:17:29.029Z",
"descriptions": [
{
"lang": "en",
"value": "We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.\n\n\n### Summary\n\nThe Grafana Operator supports loading dashboards \u0026 library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.\n\n\n### Impact\n\nIt is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.\n\n### Affected versions\n\nAll Grafana Operator versions \u003c= 5.23\n\n### Solutions and mitigations\n\nAll installations should be upgraded as soon as possible.\n\nAs a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:\n\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicy\nmetadata:\n name: \"prevent-jsonnet-dashboards\"\nspec:\n failurePolicy: Fail\n matchConstraints:\n resourceRules:\n - apiGroups: [\"grafana.integreatly.org\"]\n apiVersions: [\"v1beta1\"]\n operations: [\"CREATE\", \"UPDATE\"]\n resources: [\"grafanadashboards\", \"grafanalibrarypanels\"]\n validations:\n - expression: \"!has(object.spec.jsonnetLib)\"\n---\napiVersion: admissionregistration.k8s.io/v1\nkind: ValidatingAdmissionPolicyBinding\nmetadata:\n name: \"prevent-jsonnet-dashboards-clusterwide\"\nspec:\n policyName: \"prevent-jsonnet-dashboards\"\n validationActions: [Deny]\n\n\n\n### Acknowledgement\n\nWe would like to thank Artem Cherezov for responsibly disclosing the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:27.041Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-11769"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Operator - Namespaced User Path Traversal",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-11769",
"datePublished": "2026-06-13T04:17:41.099Z",
"dateReserved": "2026-06-09T10:52:06.229Z",
"dateUpdated": "2026-08-27T17:22:27.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28374 (GCVE-0-2026-28374)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 8.5.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T12:32:58.713813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T12:33:13.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:38.240Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-28374"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "IDOR in Annotations API allows unprivileged users to DELETE annotation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-28374",
"datePublished": "2026-05-13T19:28:40.053Z",
"dateReserved": "2026-02-27T07:16:12.218Z",
"dateUpdated": "2026-08-27T17:22:38.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33378 (GCVE-0-2026-33378)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 8.0.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T12:33:44.094482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T12:33:58.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:48.777Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33378"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33378",
"datePublished": "2026-05-13T19:28:37.606Z",
"dateReserved": "2026-03-19T07:55:06.977Z",
"dateUpdated": "2026-08-27T17:22:48.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28383 (GCVE-0-2026-28383)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 6.7.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T12:35:48.301448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T12:36:22.328Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:21.832Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-28383"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Grafana plugin resources can lead to unbounded memory allocation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-28383",
"datePublished": "2026-05-13T19:28:36.952Z",
"dateReserved": "2026-02-27T07:16:12.219Z",
"dateUpdated": "2026-08-27T17:22:21.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33376 (GCVE-0-2026-33376)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 9.4.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-16T03:56:01.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:50.919Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33376"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Auth Proxy IPv6 whitelist bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33376",
"datePublished": "2026-05-13T19:28:34.473Z",
"dateReserved": "2026-03-19T07:55:06.977Z",
"dateUpdated": "2026-08-27T17:22:50.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33380 (GCVE-0-2026-33380)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 11.6.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T15:12:34.365612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552 Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T15:12:46.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server\u0027s filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:19.705Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33380"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "SQL Expressions Read File From Disk",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33380",
"datePublished": "2026-05-13T19:28:32.915Z",
"dateReserved": "2026-03-19T07:55:06.978Z",
"dateUpdated": "2026-08-27T17:22:19.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28380 (GCVE-0-2026-28380)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Any Editor could delete any snapshot, even if they have no access to read or write them.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 9.4.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T15:54:58.435055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T15:55:03.357Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Any Editor could delete any snapshot, even if they have no access to read or write them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:39.589Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-28380"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "BAC in Snapshot API allows deletion of unauthorized dashboard snapshots",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-28380",
"datePublished": "2026-05-13T19:28:32.257Z",
"dateReserved": "2026-02-27T07:16:12.218Z",
"dateUpdated": "2026-08-27T17:22:39.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33381 (GCVE-0-2026-33381)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 9.2.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-16T03:55:59.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When a user\u0027s access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:46.706Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33381"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Users can generate Service Account tokens after permissions removal",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33381",
"datePublished": "2026-05-13T19:28:31.559Z",
"dateReserved": "2026-03-19T07:55:06.978Z",
"dateUpdated": "2026-08-27T17:22:46.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33377 (GCVE-0-2026-33377)
Vulnerability from cvelistv5
Published
2026-05-13 19:28
Modified
2026-08-27 17:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Grafana | Grafana OSS |
Version: 8.5.0 ≤ 11.6.14 Version: 11.6.14 < 11.6.14+security-04 Version: 12.0.0 ≤ 12.2.8 Version: 12.2.8 < 12.2.8+security-04 Version: 12.3.0 ≤ 12.3.6 Version: 12.3.6 < 12.3.6+security-04 Version: 12.4.0 ≤ 12.4.3 Version: 12.4.3 < 12.4.3+security-02 Version: 13.0.0 ≤ 13.0.1 Version: 13.0.1 < 13.0.1+security-01 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-16T03:55:59.661383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T18:33:09.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.14",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "11.6.14+security-04",
"status": "affected",
"version": "11.6.14",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.2.8",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.2.8+security-04",
"status": "affected",
"version": "12.2.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.3.6",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.3.6+security-04",
"status": "affected",
"version": "12.3.6",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.4.3",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "12.4.3+security-02",
"status": "affected",
"version": "12.4.3",
"versionType": "custom"
},
{
"lessThanOrEqual": "13.0.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.0.1+security-01",
"status": "affected",
"version": "13.0.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-13T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:22:32.185Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33377"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Dashboard Import Overwrites ACL \u2014 Editor Privilege Escalation to Dashboard Admin",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33377",
"datePublished": "2026-05-13T19:28:28.154Z",
"dateReserved": "2026-03-19T07:55:06.977Z",
"dateUpdated": "2026-08-27T17:22:32.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}