grafana has 38 CVEs on record between 2021 and 2026. Disclosures have slowed: 4 in the last 90 days after 13 in the 90 before. The busiest recent month was June 2026 with 7. The median CVSS is 6.5 (medium), with 3 rated critical. 5% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-22 (5) and CWE-400 (3). Most affected products: github.com/grafana/grafana (18), grafana (7), Grafana OSS (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 5% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —(2)
- Last 90 days
- 4 prev 13
Products
- github.com/grafana/grafana 18
- grafana 7
- Grafana OSS 3
- github.com/grafana/tempo 2
- github.com/grafana/agent 1
- github.com/grafana/grafana-operator 1
Worst active — by depth score
CVE-2021-39226High· 7.3Authentication bypass for viewing and deletions of snapshots85CVE-2021-43798High· 7.5Grafana path traversal84CVE-2023-3128Critical· 9.4Grafana vulnerable to Authentication Bypass by Spoofing64CVE-2026-21721High· 8.1The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action57CVE-2021-41244Critical· 9.1Grafana Fine-grained access control vulnerability51
grafana vulnerabilities
CVEs affecting grafana, newest first. Open any entry for full detail, references, and exploit status.
38 CVEsRSS
CVE-2026-76154High· 7.3A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…
CVE-2026-15815High· 8.8Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary fi…
CVE-2026-14199High· 7.1Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a del…
CVE-2026-11817Medium· 5.3CVE-2026-11817 CVE Record
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api…
CVE-2026-42127High· 7.5The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of serv…
CVE-2026-9029High· 7.3A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored…
CVE-2026-42129High· 7.7A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
CVE-2026-10601Medium· 5.4A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak inter…
CVE-2026-27878Medium· 6.5Grafana Tempo vulnerable to an out-of-memory crash
Grafana Tempo vulnerable to an out-of-memory crash
CVE-2026-11769MediumGrafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
GHSA-v82c-5c2q-hx9gMediumDuplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
CVE-2026-21728High· 7.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g
Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to …
CVE-2026-21727Low· 3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user wi…
CVE-2025-41118Critical· 9.1Pyroscope is an open-source continuous profiling database
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacke…
CVE-2026-21726Medium· 5.3Grafana Loki Path Traversal - CVE-2021-36156 Bypass
Grafana Loki Path Traversal - CVE-2021-36156 Bypass
CVE-2026-27877Medium· 6.5Grafana public dashboards disclose all direct mode datasources
Grafana public dashboards disclose all direct mode datasources
CVE-2026-28377High· 7.5Grafana Tempo has Inadequate Encryption Strength
Grafana Tempo has Inadequate Encryption Strength
CVE-2026-21724Medium· 5.4Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
CVE-2026-21721High· 8.1PoCThe dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on ot…
CVE-2026-21720High· 7.5Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that gorou…
CVE-2025-3415Medium· 4.3PoCGrafana's insecure DingDing Alert integration exposes sensitive information
Grafana's insecure DingDing Alert integration exposes sensitive information
CVE-2025-3260High· 8.3Grafana vulnerable to authenticated users bypassing dashboard, folder permissions
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions
CVE-2024-10452Low· 2.2Grafana org admin can delete pending invites in different org
Grafana org admin can delete pending invites in different org
CVE-2021-41244Critical· 9.1Grafana Fine-grained access control vulnerability
Grafana Fine-grained access control vulnerability
CVE-2021-43815Medium· 4.3Grafana directory traversal for .cvs files
Grafana directory traversal for .cvs files
CVE-2023-6152Medium· 5.4Email Validation Bypass And Preventing Sign Up From Email's Owner
Email Validation Bypass And Preventing Sign Up From Email's Owner
CVE-2021-43798High· 7.5CISA KEVPoCGrafana path traversal
Grafana path traversal
CVE-2019-19499Medium· 6.5Grafana Arbitrary File Read
Grafana Arbitrary File Read
CVE-2023-3128Critical· 9.4PoCGrafana vulnerable to Authentication Bypass by Spoofing
Grafana vulnerable to Authentication Bypass by Spoofing
CVE-2023-2183Medium· 4.1Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts