Grafana vulnerabilities, page 5
167 vulnerabilities
Known vulnerabilities in Grafana products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 42 products.
HighCVE-2022-23552grafanaGrafana stored XSS in FileUploader componentGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.
An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.
Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.EPSS0.78%HighCVE-2024-1442chainguard · grafana-fips-11.6 +10 moreUser with permissions to create a data source can CRUD all data sourcesA user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.EPSS0.80%MediumCVE-2024-1313chainguard · grafana-fips-11.6 +23 moreUsers outside an organization can delete a snapshot with its keyIt is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.
Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo
Alto Research for discovering and disclosing this vulnerability.
This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.EPSS0.65%MediumCVE-2024-11741chainguard · grafana-11.3 +14 morechainguard grafana-11.3Grafana is an open-source platform for monitoring and observability.
The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission.
Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15EPSS0.41%CriticalCVE-2024-9264chainguard · grafana-fips-11.6 +10 moreGrafana SQL Expressions allow for remote code executionThe SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.EPSS97.14%CriticalCVE-2024-5526grafana · oncallgrafana oncallGrafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers.
Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery (SSRF) vulnerability in the webhook functionallity.
This issue was fixed in version 1.5.2EPSS0.40%LowCVE-2024-10452chainguard · grafana-fips-11.6 +10 morechainguard grafana-fips-11.6Organization admins can delete pending invites created in an organization they are not part of.EPSS0.49%MediumCVE-2024-6322chainguard · grafana-fips-11.6 +11 morechainguard grafana-fips-11.6Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.EPSS0.30%HighCVE-2024-8996Gogithub.com/grafana · agent +2 moreGrafana Agent Flow on Windows Unquoted service pathUnquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM
This issue affects Agent Flow: before 0.43.2EPSS0.26%HighCVE-2024-8975Gogithub.com/grafana · alloy +1 moreGrafana Alloy on Windows Unquoted service pathUnquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM
This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.EPSS0.30%MediumCVE-2024-8118ubuntu · grafana +1 moreGrafana alerting wrong permission on datasource rule write endpointIn Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.EPSS0.58%MediumCVE-2019-13068Gogithub.com/grafana · grafana +1 moregithub.com/grafana grafanapublic/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).EPSS51.91%MediumCVE-2019-19499chainguard · grafana-fips-11.6 +10 morechainguard grafana-fips-11.6Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.EPSS3.52%HighCVE-2019-15043ubuntu · grafana +15 moreubuntu grafanaIn Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.EPSS63.39%MediumCVE-2019-15635ubuntu · grafana +1 moreubuntu grafanaAn issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.EPSS1.89%MediumCVE-2026-21726chainguard · commercial-grafana-11.6 +45 moreLoki Path Traversal - CVE-2021-36156 BypassThe CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.EPSS0.41%MediumCVE-2026-21724chainguard · grafana-fips-11.6 +11 moreMissing Protected-field Authorization in Provisioning Contact Points APIA vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.EPSS0.26%LowCVE-2026-21727chainguard · grafana-11.5 +5 moreGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 RecordA cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.
Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.EPSS0.20%HighCVE-2026-21728chainguard · commercial-grafana-11.6 +33 moreTempo query limit results in unbounded memory allocationTempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.
Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.EPSS0.64%MediumCVE-2026-21723grafana · grafana ossCVE-2026-21723 RecordThe alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.EPSS0.21%