Grafana Enterprise vulnerabilities

CVE-2025-41115 [CRITICAL] CWE-266 CVE-2025-41115: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how org SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised

CVE-2023-3128 [CRITICAL] CWE-290 CVE-2023-3128: Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email f Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

CVE-2026-15815 [HIGH] CWE-22 CVE-2026-15815: Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin arch Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the G

CVE-2026-14199 [HIGH] CWE-290 CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syn Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to co

CVE-2023-1387 [HIGH] CWE-200 CVE-2023-1387: Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has

CVE-2026-42127 [HIGH] CWE-400 CVE-2026-42127: The public dashboard query endpoint does not limit request body size before processing, allowing una The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnera

CVE-2025-2703 [MEDIUM] CWE-79 CVE-2025-2703: The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissi The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

CVE-2026-9703 [HIGH] CWE-284 CVE-2026-9703: Grafana's data source proxy did not apply role-based access control to write requests forwarded to L Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Be

CVE-2023-4399 [HIGH] CWE-183 CVE-2023-4399: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Reques Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

CVE-2026-15577 [MEDIUM] CWE-863 CVE-2026-15577: A user or service account with read-only access to Git Sync (provisioning) connections can modify a A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

CVE-2023-4822 [HIGH] CWE-269 CVE-2023-4822: Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafa Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It al

CVE-2026-17183 [HIGH] CWE-863 CVE-2026-17183: An authenticated user with permission to create or edit alert rules can bypass datasource query auth An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to q

CVE-2026-12704 [MEDIUM] CWE-294 CVE-2026-12704: When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with t

CVE-2023-0507 [MEDIUM] CWE-79 CVE-2023-0507: Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorize

CVE-2026-76154 [HIGH] CWE-79 CVE-2026-76154: A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

CVE-2026-92539 [MEDIUM] CWE-639 CVE-2026-92539: A service account with user-management permissions in one organization can read, modify, disable or A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

CVE-2026-93294 [MEDIUM] CWE-441 CVE-2026-93294: A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Re A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVE-2026-19197 [MEDIUM] CWE-862 CVE-2026-19197: A user with organization administrator permissions can delete dashboard snapshots belonging to other A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVE-2023-2183 [MEDIUM] CWE-284 CVE-2023-2183: Grafana is an open-source platform for monitoring and observability. The option to send a test ale Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to ab

CVE-2026-33374 [MEDIUM] CWE-400 CVE-2026-33374: The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing aut The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.