GR
Monitoring
Grafana
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
9.9
Max CVSS
13
New 30D
Severity mix
Critical 11High 61Medium 89Low 10
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43798 In wildKEV | 7.5 | Dec 7 | Grafana path traversal Affected: >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.8; >= 8.2.0, < 8.2.7; = 8.3.0 |
| CVE-2021-39226 In wildKEV | 7.3 | Oct 5 | Snapshot authentication bypass in grafana Affected: >= 8.0.0, < 8.1.6; < 7.5.11 |
| CVE-2026-103506 New | 8.9 | Oct 28 | SSO settings authorization bypass Affected: 13.2.0 through 13.2.4 |
| CVE-2026-15815 | 8.8 | Sep 17 | CVE-2026-15815 CVE Record Affected: 11.6.0 through 11.6.17; 12.0.0; 12.1.0; 12.2.0; 12.3.0; 12.4.0 through 12.4.10; +3 more |
| CVE-2026-11769 | 8.8 | Jun 13 | Operator - Namespaced User Path Traversal Affected: through 5.23.0 |
| CVE-2024-9264 | 8.8 | Oct 18 | Grafana SQL Expressions allow for remote code execution Affected: 11.0.0 before 11.0.5; 11.1.0 before 11.1.6; 11.2.0 before 11.2.1; 11.0.0 before 11.0.6; 11.1.0 before 11.1.7; 11.2.0 before 11.2.2 |
| CVE-2024-1442 | 8.8 | Mar 7 | User with permissions to create a data source can CRUD all data sources Affected: 8.5.0 before 9.5.7; 10.0.0 before 10.0.12; 10.1.0 before 10.1.8; 10.2.0 before 10.2.5; 10.3.0 before 10.3.4 |
| CVE-2022-23498 | 8.8 | Feb 3 | When query caching is enabled in Grafana users can query another users session Affected: >= 8.3.0-beta1, < 9.2.10 |
| CVE-2022-24812 | 8.8 | Apr 12 | FGAC API Key privilege escalation in Grafana Affected: >= 8.1.0-beta1, < 8.4.6 |
| CVE-2022-21703 | 8.8 | Feb 8 | Cross Site Request Forgery in Grafana Affected: >= 3.0-beta1, < 7.5.15; >= 8.0.0, < 8.3.5 |
| CVE-2022-31097 | 8.7 | Jul 15 | Stored XSS in Grafana's Unified Alerting Affected: >= 9.0.0, < 9.0.3; >= 8.5.0, < 8.5.9; >= 8.4.0, < 8.4.10; >= 8.0.0, < 8.3.10 |
| CVE-2026-15583 | 8.6 | Jul 15 | SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header Affected: 0.0.0 through 0.17.1 |
| CVE-2022-29170 | 8.5 | May 20 | Grafana Enterprise datasource network restrictions bypass via HTTP redirects Affected: >= 7.4.0-beta1, < 7.5.16; >= 8.0.0, < 8.5.3 |
| CVE-2025-3260 | 8.3 | Jun 2 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions Affected: 11.6.0 before 11.6.1+security-01 |
| CVE-2020-13379 | 8.2 | Jun 3 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue Affected: 3.0.1 through 7.0.1 |
| CVE-2026-14199 | 8.1 | Sep 2 | Session takeover via Auth Proxy cache key collision Affected: 11.0.0 through 11.6.17; 12.0.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 through 12.4.9; 13.0.0 through 13.0.7; 13.1.0 through 13.1.4; +1 more |
| CVE-2026-28381 | 8.1 | Jun 22 | Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT Affected: 1.14.7 through 1.14.12 |
| CVE-2026-33381 | 8.1 | May 13 | Users can generate Service Account tokens after permissions removal Affected: 9.2.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-21721 | 8.1 | Jan 27 | Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation Affected: 10.2.0 before 11.6.9; 12.0.0 before 12.0.8; 12.1.0 before 12.1.5; 12.2.0 before 12.2.3; 12.3.0 before 12.3.1 |
| CVE-2022-39306 | 8.1 | Nov 9 | Grafana contains Improper Input Validation Affected: < 8.5.15; >= 9.v9.0.0-beta1, < 9.2.4 |
| CVE-2022-39328 | 8.1 | Nov 8 | Grafana vulnerable to race condition allowing privilege escalation Affected: >= 9.2.0, < 9.2.4 |
| CVE-2022-31176 | 8.1 | Sep 2 | Grafana Image Renderer leaking files Affected: < 3.6.0 |
| CVE-2023-5123 | 8.0 | Feb 14 | Improper Path Sanitization in JSON Datasource Plugin Affected: 0.2.0 before 1.3.21 |
| CVE-2024-8996 | 7.8 | Sep 25 | Grafana Agent Flow on Windows Unquoted service path Affected: before 0.43.2 |
| CVE-2024-8975 | 7.8 | Sep 25 | Grafana Alloy on Windows Unquoted service path Affected: before 1.3.3; 1.4.0-rc.0 through 1.4.0-rc.1 |
| CVE-2022-31123 | 7.8 | Oct 13 | Grafana plugin signature bypass vulnerability Affected: < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2026-88967 New | 7.7 | Oct 28 | Azure Monitor access token disclosure via SSRF Affected: 10.0.0 through 11.6.16; 12.0.0 through 12.2.10; 12.3.0 through 12.3.11; 12.4.0 through 12.4.13; 13.0.0 through 13.0.11; 13.1.0 through 13.1.8; +1 more |
| CVE-2026-100105 New | 7.7 | Oct 28 | Alerting contact point authorization bypass via schema downgrade Affected: 12.4.0 through 12.4.13; 13.0.0 through 13.0.11; 13.1.0 through 13.1.8; 13.2.0 through 13.2.4 |
| CVE-2026-75889 | 7.7 | Aug 27 | CVE-2026-75889 CVE Record Affected: 1.0.0 through 1.18.1 |
| CVE-2026-42129 | 7.7 | Jun 22 | Path traversal in the Loki data source plugin Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2025-6023 | 7.6 | Jul 18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks Affected: 12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 |
| CVE-2026-21729 | 7.5 | Jul 16 | Loki detected_fields query limits results in unbounded memory allocation Affected: v3.0.0 before v3.7.0 |
| CVE-2026-8609 | 7.5 | Jul 10 | Pre-authentication denial of service via the OAuth login route Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-33382 | 7.5 | Jul 10 | Denial of service via unbounded request body size Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-42127 | 7.5 | Jun 22 | Pre-authentication denial of service in the public dashboard query endpoint Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-21728 | 7.5 | Apr 24 | Tempo query limit results in unbounded memory allocation Affected: 1.3.0 through 2.8.3; 2.9.0 through 2.9.1; 2.10.0 through 2.10.1 |
| CVE-2026-27880 | 7.5 | Mar 27 | OpenFeature evaluation API reads input data with no bounds Affected: v12.1.0 before v12.1.10; v12.2.0 before v12.2.8; v12.3.0 before v12.3.6; v12.4.0 before v12.4.2 |
| CVE-2026-27877 | 7.5 | Mar 27 | Public dashboards discloses all direct mode datasources Affected: 9.3.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2 |
| CVE-2026-28377 | 7.5 | Mar 26 | S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) Affected: 2.10.3 |
| CVE-2026-21720 | 7.5 | Jan 27 | Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out Affected: 3.0.0 before 11.6.9; 3.0.0 before 12.0.8; 3.0.0 before 12.1.5; 3.0.0 before 12.2.3; 3.0.0 before 12.3.1 |
| CVE-2023-4457 | 7.5 | Oct 16 | Grafana is an open-source platform for monitoring and observability Affected: 0.9.0 before 1.2.2 |
| CVE-2023-1387 | 7.5 | Apr 26 | Grafana is an open-source platform for monitoring and observability Affected: 9.1.0 before 9.2.17; 9.3.0 before 9.3.13; 9.4.0 before 9.5.0 |
| CVE-2022-31130 | 7.5 | Oct 13 | Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins Affected: < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2022-39201 | 7.5 | Oct 13 | Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins Affected: >= v5.0.0-beta1, < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2022-31107 | 7.5 | Jul 15 | Grafana account takeover via OAuth vulnerability Affected: >= 5.3, < 8.3.10; >= 8.4.0, < 8.4.10; >= 8.5.0, < 8.5.9; >= 9.0.0, < 9.0.3 |
| CVE-2022-32276 | 7.5 | Jun 17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI Affected: 8.4.3 |
| CVE-2022-32275 | 7.5 | Jun 6 | Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/ Affected: 8.4.3 |
| CVE-2021-41090 | 7.5 | Dec 8 | Instance config inline secret exposure Affected: >= 0.14.0, < 0.20.1; >= 0.21.0, < 0.21.2 |
| CVE-2021-28148 | 7.5 | Mar 22 | One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication Affected: 6.0.0 before 6.7.6; 7.0.0 before 7.3.10; 7.4.0 before 7.4.5 |
| CVE-2021-27358 | 7.5 | Mar 18 | The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used… Affected: 6.7.3 through 7.4.1 |