Grafana Oss vulnerabilities

CVE-2026-15815 [HIGH] CWE-22 CVE-2026-15815: Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin arch Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the G

CVE-2026-14199 [HIGH] CWE-290 CVE-2026-14199: Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syn Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to co

CVE-2026-33381 [HIGH] CWE-284 CVE-2026-33381: When a user's access to mint tokens for a service account is revoked, it is sometimes still possible When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

CVE-2026-42127 [HIGH] CWE-400 CVE-2026-42127: The public dashboard query endpoint does not limit request body size before processing, allowing una The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnera

CVE-2026-42129 [HIGH] CWE-22 CVE-2026-42129: A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach admi A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

CVE-2026-33376 [HIGH] CWE-1188 CVE-2026-33376: When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses sp When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

CVE-2026-9703 [HIGH] CWE-284 CVE-2026-9703: Grafana's data source proxy did not apply role-based access control to write requests forwarded to L Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Be

CVE-2026-8609 [HIGH] CWE-400 CVE-2026-8609: An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, caus An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVE-2026-33380 [MEDIUM] CWE-552 CVE-2026-33380: A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

CVE-2026-15577 [MEDIUM] CWE-863 CVE-2026-15577: A user or service account with read-only access to Git Sync (provisioning) connections can modify a A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

CVE-2026-33382 [HIGH] CWE-400 CVE-2026-33382: Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request bo Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

CVE-2026-17183 [HIGH] CWE-863 CVE-2026-17183: An authenticated user with permission to create or edit alert rules can bypass datasource query auth An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to q

CVE-2026-76154 [HIGH] CWE-79 CVE-2026-76154: A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

CVE-2026-33377 [HIGH] CWE-287 CVE-2026-33377: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. T An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

CVE-2026-93294 [MEDIUM] CWE-441 CVE-2026-93294: A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Re A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVE-2026-19197 [MEDIUM] CWE-862 CVE-2026-19197: A user with organization administrator permissions can delete dashboard snapshots belonging to other A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVE-2026-17033 [MEDIUM] CWE-79 CVE-2026-17033: An authenticated attacker with Editor access or alert.instances.external:write can submit an externa An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkBut

CVE-2026-33375 [MEDIUM] CWE-400 CVE-2026-33375: The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

CVE-2026-19475 [MEDIUM] CWE-400 CVE-2026-19475: An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-333 An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a d

CVE-2026-28376 [MEDIUM] CWE-770 CVE-2026-28376: The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a la The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.