Grafana vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
67 matching records
- Medium6.8Stored XSS in the table panel (TableNG)Check if you run itEPSS 0.24%Jul 10, 2026
- Medium5.3Pre-authentication denial of service via the OAuth login routeCheck if you run itEPSS 0.40%Jul 10, 2026
- High8.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.Check if you run itEPSS 0.34%May 13, 2026
- Medium6.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem.Check if you run itEPSS 0.37%May 13, 2026
- Medium6.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server.Check if you run itEPSS 0.33%May 13, 2026
- High7.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.Check if you run itEPSS 0.23%May 13, 2026
- High7.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.Check if you run itEPSS 0.28%May 13, 2026
- Medium6.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory.Check if you run itEPSS 0.33%May 13, 2026
- Medium6.5Any Editor could delete any snapshot, even if they have no access to read or write them.Check if you run itEPSS 0.23%May 13, 2026
- Medium6.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error.Check if you run itEPSS 0.26%May 13, 2026
- Medium6.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions.Check if you run itEPSS 0.33%May 13, 2026
- Medium4.3Editors could delete any annotation, even those they do not have read access to.Check if you run itEPSS 0.20%May 13, 2026
- High7.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.Check if you run itEPSS 0.64%Apr 24, 2026
- Low3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records.Check if you run itEPSS 0.20%Apr 15, 2026
- Medium5.3The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the…Check if you run itEPSS 0.41%Apr 15, 2026
- Critical9.1Pyroscope is an open-source continuous profiling database.Check if you run itEPSS 0.41%Apr 15, 2026
- Low1.3In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receive…Check if you run itEPSS 0.26%Apr 15, 2026
- Medium6.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.Check if you run itEPSS 0.39%Mar 27, 2026
- High7.5The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.Check if you run itEPSS 0.79%Mar 27, 2026
- Medium6.5A resample query can be used to trigger out-of-memory crashes in Grafana.Check if you run itEPSS 0.39%Mar 27, 2026
- High7.5When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.Check if you run itEPSS 0.31%Mar 27, 2026
- Critical9.1A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE).Check if you run itEPSS 1.96%Mar 27, 2026
- High7.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtai…Check if you run itEPSS 0.16%Mar 26, 2026
- Medium6.5The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memo…Check if you run itEPSS 0.45%Mar 26, 2026
- Medium4.3A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protect…Check if you run itEPSS 0.27%Mar 26, 2026