Grafana Oss vulnerabilities

CVE-2026-28380 [MEDIUM] CWE-862 CVE-2026-28380: Any Editor could delete any snapshot, even if they have no access to read or write them. Any Editor could delete any snapshot, even if they have no access to read or write them.

CVE-2026-33374 [MEDIUM] CWE-400 CVE-2026-33374: The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing aut The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

CVE-2026-33378 [MEDIUM] CWE-400 CVE-2026-33378: Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

CVE-2026-11817 [MEDIUM] CWE-863 CVE-2026-11817: This vulnerability only affects Grafana stacks configured with multiple organizations; single-organi This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other o

CVE-2026-28379 [MEDIUM] CWE-362 CVE-2026-28379: A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server cra A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

CVE-2026-28383 [MEDIUM] CWE-770 CVE-2026-28383: A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.

CVE-2026-81841 [MEDIUM] CWE-862 CVE-2026-81841: Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve fro Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing aut

CVE-2026-21723 [MEDIUM] CWE-400 CVE-2026-21723: The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) ca The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

CVE-2026-13720 [MEDIUM] CWE-285 CVE-2026-13720: An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and g An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it

CVE-2026-95502 [MEDIUM] CWE-409 CVE-2026-95502: A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memor A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

CVE-2026-9029 [MEDIUM] CWE-79 CVE-2026-9029: A user with Editor permissions can place a malicious script in the attribution field of a Geomap pan A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

CVE-2026-8595 [MEDIUM] CWE-79 CVE-2026-8595: A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a maliciou A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

CVE-2026-13719 [MEDIUM] CWE-200 CVE-2026-13719: An authenticated user can list alert rules stored in folders they are not allowed to read through th An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The ex

CVE-2026-10601 [MEDIUM] CWE-22 CVE-2026-10601: A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

CVE-2026-81842 [MEDIUM] CWE-863 CVE-2026-81842: An authenticated user with edit permission on one folder can move a library panel into another folde An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the desti

CVE-2026-28374 [MEDIUM] CWE-284 CVE-2026-28374: Editors could delete any annotation, even those they do not have read access to. The editor user can Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

CVE-2026-28378 [LOW] CWE-284 CVE-2026-28378: The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admi The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.