Grafana · week of 26 Oct 2026
Grafana security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
No changed record includes a version a customer can check.
What we still do not know
CVE-2026-103506 — Check if you run it
SSO settings authorization bypass
No version range is stored, so an installed version cannot be checked.
CVE-2026-88858 — Check if you run it
Server-side expression parser denial of service
No version range is stored, so an installed version cannot be checked.
CVE-2026-100105 — Check if you run it
Alerting contact point authorization bypass via schema downgrade
No version range is stored, so an installed version cannot be checked.
Share this note
Grafana security note, week of 26 Oct 2026: 0 records have a version a customer can check, and 3 still do not. https://zerodayfindings.com/technologies/grafana/notes/2026-W44