GR
Product
Grafana
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
9.9
Max CVSS
13
New 30D
Severity mix
Critical 11High 61Medium 89Low 10
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43798 In wildKEV | 7.5 | Dec 7 | Grafana path traversal Affected: >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.8; >= 8.2.0, < 8.2.7; = 8.3.0 |
| CVE-2021-39226 In wildKEV | 7.3 | Oct 5 | Snapshot authentication bypass in grafana Affected: >= 8.0.0, < 8.1.6; < 7.5.11 |
| CVE-2025-11539 | 9.9 | Oct 9 | Arbitrary Code Execution in Grafana Image Renderer Plugin Affected: 1.0.0 through 4.0.16 |
| CVE-2025-41115 | 9.8 | Nov 21 | Incorrect privilege assignment Affected: 12.0.0 before 12.2.1 |
| CVE-2023-3128 | 9.8 | Jun 22 | Grafana is validating Azure AD accounts based on the email claim Affected: 9.5.0 before 9.5.4; 9.4.0 before 9.4.13; 9.3.0 before 9.3.16; 9.2.0 before 9.2.20; 6.7.0 before 8.5.27 |
| CVE-2022-28660 | 9.8 | May 20 | The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used Affected: 1.1.0 before 1.2.1; 1.3.0 |
| CVE-2022-26148 | 9.8 | Mar 21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix Affected: through 7.3.4 |
| CVE-2020-27846 | 9.8 | Dec 21 | A signature verification vulnerability exists in crewjam/saml Affected: before 6.7.5; 7.0.0 before 7.2.3; 7.3.0 before 7.3.6 |
| CVE-2018-15727 | 9.8 | Aug 29 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of… Affected: 2.0.0 through 2.1.2; 3.0.0 through 3.1.1; 4.0.0 before 4.6.4; 5.0.0 before 5.2.3 |
| CVE-2026-19516 | 9.1 | Aug 11 | CVE-2026-19516 CVE Record Affected: 0.0.0 through 1.0.0 |
| CVE-2025-41118 | 9.1 | Apr 15 | Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection Affected: 1.0.0 before 1.16.0 |
| CVE-2026-27876 | 9.1 | Mar 27 | RCE on Grafana via sqlExpressions Affected: 11.6.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2 |
| CVE-2024-5526 | 9.1 | Jun 5 | Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically… Affected: 1.1.37 before 1.5.2 |
| CVE-2026-103506 New | 8.9 | Oct 28 | SSO settings authorization bypass Affected: 13.2.0 through 13.2.4 |
| CVE-2026-15815 | 8.8 | Sep 17 | CVE-2026-15815 CVE Record Affected: 11.6.0 through 11.6.17; 12.0.0; 12.1.0; 12.2.0; 12.3.0; 12.4.0 through 12.4.10; +3 more |
| CVE-2026-11769 | 8.8 | Jun 13 | Operator - Namespaced User Path Traversal Affected: through 5.23.0 |
| CVE-2024-9264 | 8.8 | Oct 18 | Grafana SQL Expressions allow for remote code execution Affected: 11.0.0 before 11.0.5; 11.1.0 before 11.1.6; 11.2.0 before 11.2.1; 11.0.0 before 11.0.6; 11.1.0 before 11.1.7; 11.2.0 before 11.2.2 |
| CVE-2024-1442 | 8.8 | Mar 7 | User with permissions to create a data source can CRUD all data sources Affected: 8.5.0 before 9.5.7; 10.0.0 before 10.0.12; 10.1.0 before 10.1.8; 10.2.0 before 10.2.5; 10.3.0 before 10.3.4 |
| CVE-2022-23498 | 8.8 | Feb 3 | When query caching is enabled in Grafana users can query another users session Affected: >= 8.3.0-beta1, < 9.2.10 |
| CVE-2022-24812 | 8.8 | Apr 12 | FGAC API Key privilege escalation in Grafana Affected: >= 8.1.0-beta1, < 8.4.6 |
| CVE-2022-21703 | 8.8 | Feb 8 | Cross Site Request Forgery in Grafana Affected: >= 3.0-beta1, < 7.5.15; >= 8.0.0, < 8.3.5 |
| CVE-2022-31097 | 8.7 | Jul 15 | Stored XSS in Grafana's Unified Alerting Affected: >= 9.0.0, < 9.0.3; >= 8.5.0, < 8.5.9; >= 8.4.0, < 8.4.10; >= 8.0.0, < 8.3.10 |
| CVE-2026-15583 | 8.6 | Jul 15 | SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header Affected: 0.0.0 through 0.17.1 |
| CVE-2022-29170 | 8.5 | May 20 | Grafana Enterprise datasource network restrictions bypass via HTTP redirects Affected: >= 7.4.0-beta1, < 7.5.16; >= 8.0.0, < 8.5.3 |
| CVE-2025-3260 | 8.3 | Jun 2 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions Affected: 11.6.0 before 11.6.1+security-01 |
| CVE-2020-13379 | 8.2 | Jun 3 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue Affected: 3.0.1 through 7.0.1 |
| CVE-2026-14199 | 8.1 | Sep 2 | Session takeover via Auth Proxy cache key collision Affected: 11.0.0 through 11.6.17; 12.0.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 through 12.4.9; 13.0.0 through 13.0.7; 13.1.0 through 13.1.4; +1 more |
| CVE-2026-28381 | 8.1 | Jun 22 | Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT Affected: 1.14.7 through 1.14.12 |
| CVE-2026-33381 | 8.1 | May 13 | Users can generate Service Account tokens after permissions removal Affected: 9.2.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-21721 | 8.1 | Jan 27 | Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation Affected: 10.2.0 before 11.6.9; 12.0.0 before 12.0.8; 12.1.0 before 12.1.5; 12.2.0 before 12.2.3; 12.3.0 before 12.3.1 |
| CVE-2022-39306 | 8.1 | Nov 9 | Grafana contains Improper Input Validation Affected: < 8.5.15; >= 9.v9.0.0-beta1, < 9.2.4 |
| CVE-2022-39328 | 8.1 | Nov 8 | Grafana vulnerable to race condition allowing privilege escalation Affected: >= 9.2.0, < 9.2.4 |
| CVE-2022-31176 | 8.1 | Sep 2 | Grafana Image Renderer leaking files Affected: < 3.6.0 |
| CVE-2023-5123 | 8.0 | Feb 14 | Improper Path Sanitization in JSON Datasource Plugin Affected: 0.2.0 before 1.3.21 |
| CVE-2024-8996 | 7.8 | Sep 25 | Grafana Agent Flow on Windows Unquoted service path Affected: before 0.43.2 |
| CVE-2024-8975 | 7.8 | Sep 25 | Grafana Alloy on Windows Unquoted service path Affected: before 1.3.3; 1.4.0-rc.0 through 1.4.0-rc.1 |
| CVE-2022-31123 | 7.8 | Oct 13 | Grafana plugin signature bypass vulnerability Affected: < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2026-88967 New | 7.7 | Oct 28 | Azure Monitor access token disclosure via SSRF Affected: 10.0.0 through 11.6.16; 12.0.0 through 12.2.10; 12.3.0 through 12.3.11; 12.4.0 through 12.4.13; 13.0.0 through 13.0.11; 13.1.0 through 13.1.8; +1 more |
| CVE-2026-100105 New | 7.7 | Oct 28 | Alerting contact point authorization bypass via schema downgrade Affected: 12.4.0 through 12.4.13; 13.0.0 through 13.0.11; 13.1.0 through 13.1.8; 13.2.0 through 13.2.4 |
| CVE-2026-75889 | 7.7 | Aug 27 | CVE-2026-75889 CVE Record Affected: 1.0.0 through 1.18.1 |
| CVE-2026-42129 | 7.7 | Jun 22 | Path traversal in the Loki data source plugin Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2025-6023 | 7.6 | Jul 18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks Affected: 12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 |
| CVE-2026-21729 | 7.5 | Jul 16 | Loki detected_fields query limits results in unbounded memory allocation Affected: v3.0.0 before v3.7.0 |
| CVE-2026-8609 | 7.5 | Jul 10 | Pre-authentication denial of service via the OAuth login route Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-33382 | 7.5 | Jul 10 | Denial of service via unbounded request body size Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-42127 | 7.5 | Jun 22 | Pre-authentication denial of service in the public dashboard query endpoint Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-21728 | 7.5 | Apr 24 | Tempo query limit results in unbounded memory allocation Affected: 1.3.0 through 2.8.3; 2.9.0 through 2.9.1; 2.10.0 through 2.10.1 |
| CVE-2026-27880 | 7.5 | Mar 27 | OpenFeature evaluation API reads input data with no bounds Affected: v12.1.0 before v12.1.10; v12.2.0 before v12.2.8; v12.3.0 before v12.3.6; v12.4.0 before v12.4.2 |
| CVE-2026-27877 | 7.5 | Mar 27 | Public dashboards discloses all direct mode datasources Affected: 9.3.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2 |
| CVE-2026-28377 | 7.5 | Mar 26 | S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) Affected: 2.10.3 |