Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-17183 (GCVE-0-2026-17183)

Vulnerability from cvelistv5 – Published: 2026-08-19 17:30 – Updated: 2026-08-19 17:36

Title

CVE-2026-17183 CVE Record

Summary

Summary An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource. The alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid. ## Impact This bypass can expose data accessible through Grafana's configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High. Integrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated. ## Attack prerequisites - Authenticated, low-privileged user in the same Grafana organization - Permission to create or edit alert rules in an accessible folder - No datasources:query permission for the targeted datasource - Knowledge or discovery of the targeted datasource UID - No user interaction required ## Technical details / root cause 1. The attacker submits an alert-rule query with queryType: "__expr__" and the UID of a real datasource. 2. The datasource authorization helper skips permission enforcement when query.QueryType == "__expr__". 3. queryType is client-controlled and is not validated against the referenced datasource. 4. During evaluation, Grafana selects and loads the actual datasource using DatasourceUID, not the spoofed queryType. 5. The query therefore executes using Grafana's datasource credentials despite the caller lacking datasources:query. The root cause is inconsistent query classification between authorization and execution: authorization trusts queryType, while execution trusts DatasourceUID. ## Affected product / component - Product: Grafana OSS - Component: Unified Alerting / ngalert - Area: Alert-rule datasource authorization and query evaluation - Confirmed version: Grafana OSS 13.0.1 - Affected version range: not yet assessed ## Severity - CVSS 3.1: 7.1 High - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - CWE-863: Incorrect Authorization Scope is Unchanged because the vulnerable authorization decision and resulting impact remain within Grafana's security authority. ## Source - Researcher: czarflix - Intigriti report: GRAFANALABS-F996ATD7 - Report URL: https://app.intigriti.com/company/submissions/GRAFANALABS-F996ATD7 ## Related report / duplicate assessment This is a default-Grafana-OSS reproduction of the root cause previously reported in GRAFANALABS-IAQAFIXI. The earlier submission was archived as Not Applicable because its proof of concept depended on Cloud/Enterprise-specific permission mechanisms, and the researcher was invited to demonstrate the issue under default OSS permissions. This report establishes that missing prerequisite and should be treated as the actionable OSS submission, not dismissed as a duplicate. VUL-2026-0095 and VUL-2026-0126 concern Enterprise Recorded Queries and have different components, endpoints, and root causes; they are related authorization issues but not duplicates. ## Recommended remediation - Do not exempt a query from datasource authorization based solely on client-controlled queryType. - Resolve the referenced datasource server-side before authorization and apply datasources:query whenever the resolved UID represents a real datasource. - Require expression queries to reference only the canonical server-side expression datasource and reject mismatches such as queryType: "__expr__" paired with a real datasource UID. - Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict. - Add regression coverage for an OSS user with folder-level alert-rule edit permission but without datasource query permission, including mismatched queryType and datasourceUid values.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-863 - INCORRECT AUTHORIZATION

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.4.0 , ≤ 13.1.1 (semver)

Date Public

2026-07-24 18:38

Credits

czarflix

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "13.1.1",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "czarflix"
        }
      ],
      "datePublic": "2026-07-24T18:38:02.945Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Summary\n\nAn authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource.\n\nThe alert-rule authorization path treats the query as a server-side expression and skips datasource permission enforcement, while the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid.\n\n## Impact\n\nThis bypass can expose data accessible through Grafana\u0027s configured datasource credentials to a low-privileged user who is not authorized to query that datasource directly. Confidentiality impact is High.\n\nIntegrity impact is Low because some datasource backends and configured credentials may permit state-changing queries. No availability impact has been demonstrated.\n\n## Attack prerequisites\n\n- Authenticated, low-privileged user in the same Grafana organization\n- Permission to create or edit alert rules in an accessible folder\n- No datasources:query permission for the targeted datasource\n- Knowledge or discovery of the targeted datasource UID\n- No user interaction required\n\n## Technical details / root cause\n\n1. The attacker submits an alert-rule query with queryType: \"__expr__\" and the UID of a real datasource.\n2. The datasource authorization helper skips permission enforcement when query.QueryType == \"__expr__\".\n3. queryType is client-controlled and is not validated against the referenced datasource.\n4. During evaluation, Grafana selects and loads the actual datasource using DatasourceUID, not the spoofed queryType.\n5. The query therefore executes using Grafana\u0027s datasource credentials despite the caller lacking datasources:query.\n\nThe root cause is inconsistent query classification between authorization and execution: authorization trusts queryType, while execution trusts DatasourceUID.\n\n## Affected product / component\n\n- Product: Grafana OSS\n- Component: Unified Alerting / ngalert\n- Area: Alert-rule datasource authorization and query evaluation\n- Confirmed version: Grafana OSS 13.0.1\n- Affected version range: not yet assessed\n\n## Severity\n\n- CVSS 3.1: 7.1 High\n- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\n- CWE-863: Incorrect Authorization\n\nScope is Unchanged because the vulnerable authorization decision and resulting impact remain within Grafana\u0027s security authority.\n\n## Source\n\n- Researcher: czarflix\n- Intigriti report: GRAFANALABS-F996ATD7\n- Report URL: https://app.intigriti.com/company/submissions/GRAFANALABS-F996ATD7\n\n## Related report / duplicate assessment\n\nThis is a default-Grafana-OSS reproduction of the root cause previously reported in GRAFANALABS-IAQAFIXI. The earlier submission was archived as Not Applicable because its proof of concept depended on Cloud/Enterprise-specific permission mechanisms, and the researcher was invited to demonstrate the issue under default OSS permissions. This report establishes that missing prerequisite and should be treated as the actionable OSS submission, not dismissed as a duplicate.\n\nVUL-2026-0095 and VUL-2026-0126 concern Enterprise Recorded Queries and have different components, endpoints, and root causes; they are related authorization issues but not duplicates.\n\n## Recommended remediation\n\n- Do not exempt a query from datasource authorization based solely on client-controlled queryType.\n- Resolve the referenced datasource server-side before authorization and apply datasources:query whenever the resolved UID represents a real datasource.\n- Require expression queries to reference only the canonical server-side expression datasource and reject mismatches such as queryType: \"__expr__\" paired with a real datasource UID.\n- Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.\n- Add regression coverage for an OSS user with folder-level alert-rule edit permission but without datasource query permission, including mismatched queryType and datasourceUid values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: INCORRECT AUTHORIZATION",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:36:08.450Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-17183"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-17183 CVE Record"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-17183",
    "datePublished": "2026-08-19T17:30:06.798Z",
    "dateReserved": "2026-07-24T18:38:02.221Z",
    "dateUpdated": "2026-08-19T17:36:08.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11817 (GCVE-0-2026-11817)

Vulnerability from cvelistv5 – Published: 2026-08-17 21:28 – Updated: 2026-08-19 17:29

Title

CVE-2026-11817 CVE Record

Summary

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 15:22 UTC

CWE

CWE-863

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 11.2.0 , ≤ 11.6.16 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) Affected: 13.1.0 , ≤ 13.1.0 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver)
Grafana	Grafana Enterprise	Affected: 13.0.0 , ≤ 13.0.3 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 11.2.0 , ≤ 11.6.16 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver) Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 13.1.0 , ≤ 13.1.0 (semver)

Date Public

2026-07-17 14:01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T15:22:39.226844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T15:22:45.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.5",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.16",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.3",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.1.0",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.10",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.8",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "13.0.3",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.10",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.16",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.8",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.5",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.1.0",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-17T14:01:45.422Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:29:58.813Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-11817"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-11817 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-11817",
    "datePublished": "2026-08-17T21:28:17.497Z",
    "dateReserved": "2026-06-09T16:24:38.153Z",
    "dateUpdated": "2026-08-19T17:29:58.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19516 (GCVE-0-2026-19516)

Vulnerability from cvelistv5 – Published: 2026-08-11 05:28 – Updated: 2026-08-19 17:30

Title

CVE-2026-19516 CVE Record

Summary

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 17:05 UTC

CWE

CWE-918

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana MCP Server	Affected: 0.0.0 , ≤ 1.0.0 (semver)
Grafana	mcp-grafana	Affected: 0.0.0 , ≤ 1.0.0 (semver)

Date Public

2026-08-11 05:23

Credits

foguel (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19516",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T17:05:21.230758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T17:05:49.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana MCP Server",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "mcp-grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "foguel (Researcher)"
        }
      ],
      "datePublic": "2026-08-11T05:23:27.801Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana\u0027s outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:01.042Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-19516"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-19516 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-19516",
    "datePublished": "2026-08-11T05:28:30.662Z",
    "dateReserved": "2026-08-11T05:23:23.935Z",
    "dateUpdated": "2026-08-19T17:30:01.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9765 (GCVE-0-2026-9765)

Vulnerability from cvelistv5 – Published: 2026-07-24 12:23 – Updated: 2026-07-24 14:47

Title

CVE-2026-9765 CVE Record

Summary

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 14:47 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana IRM	Affected: 1.0.0 , ≤ 1.164.0 (semver)

Date Public

2026-06-27 20:25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T14:47:15.168863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T14:47:18.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana IRM",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.164.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-27T20:25:07.981Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Note: The CVE and blog post don\u0027t exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T12:23:14.114Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-9765"
        }
      ],
      "source": {
        "discovery": "PEN_TEST"
      },
      "title": "CVE-2026-9765 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-9765",
    "datePublished": "2026-07-24T12:23:14.114Z",
    "dateReserved": "2026-05-27T19:51:51.271Z",
    "dateUpdated": "2026-07-24T14:47:18.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21723 (GCVE-0-2026-21723)

Vulnerability from cvelistv5 – Published: 2026-07-23 01:48 – Updated: 2026-08-19 17:30

Title

CVE-2026-21723 Record

Summary

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:15 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.0.0 , ≤ 11.0.0 (semver) Affected: 11.0.0 , ≤ 11.6.10 (semver) Affected: 12.0.0 , ≤ 12.0.9 (semver) Affected: 12.1.0 , ≤ 12.1.6 (semver) Affected: 12.2.0 , ≤ 12.2.4 (semver) Affected: 12.3.0 , ≤ 12.3.2 (semver)

Date Public

2026-07-22 01:42

Credits

nacl (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:15:50.650728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:16:10.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.10",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.0.9",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.6",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.4",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.2",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "nacl (Researcher)"
        }
      ],
      "datePublic": "2026-07-22T01:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:05.274Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21723"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-21723 Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21723",
    "datePublished": "2026-07-23T01:48:16.245Z",
    "dateReserved": "2026-01-05T09:26:06.214Z",
    "dateUpdated": "2026-08-19T17:30:05.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21729 (GCVE-0-2026-21729)

Vulnerability from cvelistv5 – Published: 2026-07-16 03:12 – Updated: 2026-08-19 17:30

Title

Loki detected_fields query limits results in unbounded memory allocation

Summary

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 12:45 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Loki	Affected: v3.0.0 , < v3.7.0 (semver)

Date Public

2026-02-23 07:50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21729",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T12:45:38.984777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:54:28.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem",
            "Cloud"
          ],
          "product": "Loki",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "v3.7.0",
              "status": "affected",
              "version": "v3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-02-23T07:50:28.948Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:10.204Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21729"
        }
      ],
      "source": {
        "discovery": "INTERNAL_FINDING"
      },
      "title": "Loki detected_fields query limits results in unbounded memory allocation",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21729",
    "datePublished": "2026-07-16T03:12:07.912Z",
    "dateReserved": "2026-01-05T09:26:06.215Z",
    "dateUpdated": "2026-08-19T17:30:10.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15583 (GCVE-0-2026-15583)

Vulnerability from cvelistv5 – Published: 2026-07-15 07:29 – Updated: 2026-08-19 17:30

Title

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

Summary

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 14:45 UTC

CWE

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana MCP Server	Affected: 0.0.0 , ≤ 0.17.1 (semver)

Date Public

2026-07-15 07:22

Credits

cybersec42

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:45:45.760884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-610",
                "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:46:09.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana MCP Server",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "0.17.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cybersec42"
        }
      ],
      "datePublic": "2026-07-15T07:22:44.434Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server\u0027s environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:04.765Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-15583"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-15583",
    "datePublished": "2026-07-15T07:29:48.038Z",
    "dateReserved": "2026-07-13T11:27:32.132Z",
    "dateUpdated": "2026-08-19T17:30:04.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8595 (GCVE-0-2026-8595)

Vulnerability from cvelistv5 – Published: 2026-07-10 14:59 – Updated: 2026-08-19 17:30

Title

Stored XSS in the table panel (TableNG)

Summary

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:59 UTC

CWE

CWE-79
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

avamost369 (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:59:08.422134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:59:19.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "avamost369 (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:16.088Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-8595"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Stored XSS in the table panel (TableNG)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-8595",
    "datePublished": "2026-07-10T14:59:35.891Z",
    "dateReserved": "2026-05-14T12:50:43.291Z",
    "dateUpdated": "2026-08-19T17:30:16.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8609 (GCVE-0-2026-8609)

Vulnerability from cvelistv5 – Published: 2026-07-10 14:58 – Updated: 2026-08-19 17:30

Title

Pre-authentication denial of service via the OAuth login route

Summary

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:53 UTC

CWE

CWE-400
CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

cyberjoker (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:53:40.169487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:53:51.365Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cyberjoker (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:11.293Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-8609"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Pre-authentication denial of service via the OAuth login route",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-8609",
    "datePublished": "2026-07-10T14:58:33.522Z",
    "dateReserved": "2026-05-14T16:01:42.297Z",
    "dateUpdated": "2026-08-19T17:30:11.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33382 (GCVE-0-2026-33382)

Vulnerability from cvelistv5 – Published: 2026-07-10 14:58 – Updated: 2026-08-19 17:30

Title

Denial of service via unbounded request body size

Summary

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:59 UTC

CWE

CWE-400

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:59:38.846803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:59:43.742Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:04.231Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33382"
        }
      ],
      "source": {
        "discovery": "INTERNAL_FINDING"
      },
      "title": "Denial of service via unbounded request body size",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33382",
    "datePublished": "2026-07-10T14:58:23.329Z",
    "dateReserved": "2026-03-19T07:55:06.978Z",
    "dateUpdated": "2026-08-19T17:30:04.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28378 (GCVE-0-2026-28378)

Vulnerability from cvelistv5 – Published: 2026-07-07 21:08 – Updated: 2026-08-19 17:30

Title

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Summary

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 13:50 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 11.6.13 (semver) Affected: 12.1.0 , ≤ 12.1.9 (semver) Affected: 12.2.0 , ≤ 12.2.7 (semver) Affected: 12.3.0 , ≤ 12.3.5 (semver) Affected: 12.4.0 , ≤ 12.4.1 (semver)
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.13 (semver) Affected: 12.1.0 , ≤ 12.1.9 (semver) Affected: 12.2.0 , ≤ 12.2.7 (semver) Affected: 12.3.0 , ≤ 12.3.5 (semver) Affected: 12.4.0 , ≤ 12.4.1 (semver)

Date Public

2026-03-24 15:50

Credits

rpgsec (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:50:28.034051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T15:38:39.070Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.13",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.9",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.7",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.5",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.1",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.13",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.9",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.7",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.5",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.1",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rpgsec (Researcher)"
        }
      ],
      "datePublic": "2026-03-24T15:50:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard\u0027s identifiers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:12.362Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28378"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28378",
    "datePublished": "2026-07-07T21:08:04.579Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-08-19T17:30:12.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42127 (GCVE-0-2026-42127)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:31 – Updated: 2026-08-19 17:30

Title

Pre-authentication denial of service in the public dashboard query endpoint

Summary

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:28 UTC

CWE

CWE-400
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

Charlie Lewis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:28:16.184877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:28:35.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Charlie Lewis"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:10.759Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Pre-authentication denial of service in the public dashboard query endpoint",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-42127",
    "datePublished": "2026-06-22T16:31:28.096Z",
    "dateReserved": "2026-04-24T15:38:08.066Z",
    "dateUpdated": "2026-08-19T17:30:10.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28381 (GCVE-0-2026-28381)

Vulnerability from cvelistv5 – Published: 2026-06-22 13:20 – Updated: 2026-06-24 15:58

Title

Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

Summary

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 15:43 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Snowflake Datasource	Affected: 1.14.7 , ≤ 1.14.12 (semver)

Date Public

2026-05-15 17:00

Credits

stargravy (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:43:02.758856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:58:25.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Datasource",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.14.12",
              "status": "affected",
              "version": "1.14.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "stargravy (Researcher)"
        }
      ],
      "datePublic": "2026-05-15T17:00:39.039Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T13:20:29.440Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28381"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28381",
    "datePublished": "2026-06-22T13:20:29.440Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-06-24T15:58:25.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9029 (GCVE-0-2026-9029)

Vulnerability from cvelistv5 – Published: 2026-06-22 13:18 – Updated: 2026-08-19 17:30

Title

Stored XSS in the Geomap panel tile-layer attribution

Summary

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 03:55 UTC

CWE

CWE-79
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

trailerb18 (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T03:55:45.644989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:55:58.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "trailerb18 (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel\u0027s XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:03.725Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-9029"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Stored XSS in the Geomap panel tile-layer attribution",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-9029",
    "datePublished": "2026-06-22T13:18:40.770Z",
    "dateReserved": "2026-05-19T15:28:45.662Z",
    "dateUpdated": "2026-08-19T17:30:03.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10601 (GCVE-0-2026-10601)

Vulnerability from cvelistv5 – Published: 2026-06-22 13:18 – Updated: 2026-08-19 17:30

Title

Path traversal in the Tempo and Loki data source plugins

Summary

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 15:44 UTC

CWE

CWE-22
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

homb (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10601",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:44:03.006985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:54:19.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "homb (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:14.483Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-10601"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Path traversal in the Tempo and Loki data source plugins",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-10601",
    "datePublished": "2026-06-22T13:18:31.531Z",
    "dateReserved": "2026-06-02T09:57:26.570Z",
    "dateUpdated": "2026-08-19T17:30:14.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11817 (GCVE-0-2026-11817)

Vulnerability from nvd – Published: 2026-08-17 21:28 – Updated: 2026-08-19 17:29

Title

CVE-2026-11817 CVE Record

Summary

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 15:22 UTC

CWE

CWE-863

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 11.2.0 , ≤ 11.6.16 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) Affected: 13.1.0 , ≤ 13.1.0 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver)
Grafana	Grafana Enterprise	Affected: 13.0.0 , ≤ 13.0.3 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 11.2.0 , ≤ 11.6.16 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver) Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 13.1.0 , ≤ 13.1.0 (semver)

Date Public

2026-07-17 14:01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T15:22:39.226844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T15:22:45.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.5",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.16",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.3",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.1.0",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.10",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.8",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "13.0.3",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.10",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.16",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.8",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.5",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.1.0",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-17T14:01:45.422Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:29:58.813Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-11817"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-11817 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-11817",
    "datePublished": "2026-08-17T21:28:17.497Z",
    "dateReserved": "2026-06-09T16:24:38.153Z",
    "dateUpdated": "2026-08-19T17:29:58.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19516 (GCVE-0-2026-19516)

Vulnerability from nvd – Published: 2026-08-11 05:28 – Updated: 2026-08-19 17:30

Title

CVE-2026-19516 CVE Record

Summary

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 17:05 UTC

CWE

CWE-918

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana MCP Server	Affected: 0.0.0 , ≤ 1.0.0 (semver)
Grafana	mcp-grafana	Affected: 0.0.0 , ≤ 1.0.0 (semver)

Date Public

2026-08-11 05:23

Credits

foguel (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19516",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T17:05:21.230758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T17:05:49.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana MCP Server",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "mcp-grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "foguel (Researcher)"
        }
      ],
      "datePublic": "2026-08-11T05:23:27.801Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana\u0027s outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:01.042Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-19516"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-19516 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-19516",
    "datePublished": "2026-08-11T05:28:30.662Z",
    "dateReserved": "2026-08-11T05:23:23.935Z",
    "dateUpdated": "2026-08-19T17:30:01.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9765 (GCVE-0-2026-9765)

Vulnerability from nvd – Published: 2026-07-24 12:23 – Updated: 2026-07-24 14:47

Title

CVE-2026-9765 CVE Record

Summary

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 14:47 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana IRM	Affected: 1.0.0 , ≤ 1.164.0 (semver)

Date Public

2026-06-27 20:25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T14:47:15.168863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T14:47:18.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana IRM",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.164.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-27T20:25:07.981Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Note: The CVE and blog post don\u0027t exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T12:23:14.114Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-9765"
        }
      ],
      "source": {
        "discovery": "PEN_TEST"
      },
      "title": "CVE-2026-9765 CVE Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-9765",
    "datePublished": "2026-07-24T12:23:14.114Z",
    "dateReserved": "2026-05-27T19:51:51.271Z",
    "dateUpdated": "2026-07-24T14:47:18.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21723 (GCVE-0-2026-21723)

Vulnerability from nvd – Published: 2026-07-23 01:48 – Updated: 2026-08-19 17:30

Title

CVE-2026-21723 Record

Summary

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:15 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 8.0.0 , ≤ 11.0.0 (semver) Affected: 11.0.0 , ≤ 11.6.10 (semver) Affected: 12.0.0 , ≤ 12.0.9 (semver) Affected: 12.1.0 , ≤ 12.1.6 (semver) Affected: 12.2.0 , ≤ 12.2.4 (semver) Affected: 12.3.0 , ≤ 12.3.2 (semver)

Date Public

2026-07-22 01:42

Credits

nacl (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:15:50.650728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:16:10.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.6.10",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.0.9",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.6",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.4",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.2",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "nacl (Researcher)"
        }
      ],
      "datePublic": "2026-07-22T01:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:05.274Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21723"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "CVE-2026-21723 Record",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21723",
    "datePublished": "2026-07-23T01:48:16.245Z",
    "dateReserved": "2026-01-05T09:26:06.214Z",
    "dateUpdated": "2026-08-19T17:30:05.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21729 (GCVE-0-2026-21729)

Vulnerability from nvd – Published: 2026-07-16 03:12 – Updated: 2026-08-19 17:30

Title

Loki detected_fields query limits results in unbounded memory allocation

Summary

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 12:45 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Loki	Affected: v3.0.0 , < v3.7.0 (semver)

Date Public

2026-02-23 07:50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21729",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T12:45:38.984777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:54:28.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "OnPrem",
            "Cloud"
          ],
          "product": "Loki",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "v3.7.0",
              "status": "affected",
              "version": "v3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-02-23T07:50:28.948Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:10.204Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21729"
        }
      ],
      "source": {
        "discovery": "INTERNAL_FINDING"
      },
      "title": "Loki detected_fields query limits results in unbounded memory allocation",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21729",
    "datePublished": "2026-07-16T03:12:07.912Z",
    "dateReserved": "2026-01-05T09:26:06.215Z",
    "dateUpdated": "2026-08-19T17:30:10.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15583 (GCVE-0-2026-15583)

Vulnerability from nvd – Published: 2026-07-15 07:29 – Updated: 2026-08-19 17:30

Title

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

Summary

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 14:45 UTC

CWE

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana MCP Server	Affected: 0.0.0 , ≤ 0.17.1 (semver)

Date Public

2026-07-15 07:22

Credits

cybersec42

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:45:45.760884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-610",
                "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:46:09.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana MCP Server",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "0.17.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cybersec42"
        }
      ],
      "datePublic": "2026-07-15T07:22:44.434Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server\u0027s environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:04.765Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-15583"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-15583",
    "datePublished": "2026-07-15T07:29:48.038Z",
    "dateReserved": "2026-07-13T11:27:32.132Z",
    "dateUpdated": "2026-08-19T17:30:04.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8609 (GCVE-0-2026-8609)

Vulnerability from nvd – Published: 2026-07-10 14:58 – Updated: 2026-08-19 17:30

Title

Pre-authentication denial of service via the OAuth login route

Summary

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:53 UTC

CWE

CWE-400
CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

cyberjoker (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:53:40.169487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:53:51.365Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cyberjoker (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:11.293Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-8609"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Pre-authentication denial of service via the OAuth login route",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-8609",
    "datePublished": "2026-07-10T14:58:33.522Z",
    "dateReserved": "2026-05-14T16:01:42.297Z",
    "dateUpdated": "2026-08-19T17:30:11.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8595 (GCVE-0-2026-8595)

Vulnerability from nvd – Published: 2026-07-10 14:59 – Updated: 2026-08-19 17:30

Title

Stored XSS in the table panel (TableNG)

Summary

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:59 UTC

CWE

CWE-79
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

avamost369 (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:59:08.422134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:59:19.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "avamost369 (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:16.088Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-8595"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Stored XSS in the table panel (TableNG)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-8595",
    "datePublished": "2026-07-10T14:59:35.891Z",
    "dateReserved": "2026-05-14T12:50:43.291Z",
    "dateUpdated": "2026-08-19T17:30:16.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33382 (GCVE-0-2026-33382)

Vulnerability from nvd – Published: 2026-07-10 14:58 – Updated: 2026-08-19 17:30

Title

Denial of service via unbounded request body size

Summary

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:59 UTC

CWE

CWE-400

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33382",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:59:38.846803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:59:43.742Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:04.231Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-33382"
        }
      ],
      "source": {
        "discovery": "INTERNAL_FINDING"
      },
      "title": "Denial of service via unbounded request body size",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-33382",
    "datePublished": "2026-07-10T14:58:23.329Z",
    "dateReserved": "2026-03-19T07:55:06.978Z",
    "dateUpdated": "2026-08-19T17:30:04.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28378 (GCVE-0-2026-28378)

Vulnerability from nvd – Published: 2026-07-07 21:08 – Updated: 2026-08-19 17:30

Title

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Summary

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 13:50 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 11.6.13 (semver) Affected: 12.1.0 , ≤ 12.1.9 (semver) Affected: 12.2.0 , ≤ 12.2.7 (semver) Affected: 12.3.0 , ≤ 12.3.5 (semver) Affected: 12.4.0 , ≤ 12.4.1 (semver)
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.13 (semver) Affected: 12.1.0 , ≤ 12.1.9 (semver) Affected: 12.2.0 , ≤ 12.2.7 (semver) Affected: 12.3.0 , ≤ 12.3.5 (semver) Affected: 12.4.0 , ≤ 12.4.1 (semver)

Date Public

2026-03-24 15:50

Credits

rpgsec (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T13:50:28.034051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T15:38:39.070Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.13",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.9",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.7",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.5",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.1",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.13",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.9",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.7",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.5",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.1",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rpgsec (Researcher)"
        }
      ],
      "datePublic": "2026-03-24T15:50:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard\u0027s identifiers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:12.362Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28378"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28378",
    "datePublished": "2026-07-07T21:08:04.579Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-08-19T17:30:12.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42127 (GCVE-0-2026-42127)

Vulnerability from nvd – Published: 2026-06-22 16:31 – Updated: 2026-08-19 17:30

Title

Pre-authentication denial of service in the public dashboard query endpoint

Summary

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:28 UTC

CWE

CWE-400
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

Charlie Lewis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:28:16.184877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:28:35.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Charlie Lewis"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:10.759Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Pre-authentication denial of service in the public dashboard query endpoint",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-42127",
    "datePublished": "2026-06-22T16:31:28.096Z",
    "dateReserved": "2026-04-24T15:38:08.066Z",
    "dateUpdated": "2026-08-19T17:30:10.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9029 (GCVE-0-2026-9029)

Vulnerability from nvd – Published: 2026-06-22 13:18 – Updated: 2026-08-19 17:30

Title

Stored XSS in the Geomap panel tile-layer attribution

Summary

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 03:55 UTC

CWE

CWE-79
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

trailerb18 (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T03:55:45.644989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:55:58.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "trailerb18 (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel\u0027s XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:03.725Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-9029"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Stored XSS in the Geomap panel tile-layer attribution",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-9029",
    "datePublished": "2026-06-22T13:18:40.770Z",
    "dateReserved": "2026-05-19T15:28:45.662Z",
    "dateUpdated": "2026-08-19T17:30:03.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42129 (GCVE-0-2026-42129)

Vulnerability from nvd – Published: 2026-06-22 13:18 – Updated: 2026-08-19 17:30

Title

Path traversal in the Loki data source plugin

Summary

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 15:44 UTC

CWE

CWE-22
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

khanmarshal (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42129",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:44:32.401117Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:56:38.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "khanmarshal (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:07.990Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-42129"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Path traversal in the Loki data source plugin",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-42129",
    "datePublished": "2026-06-22T13:18:27.365Z",
    "dateReserved": "2026-04-24T15:38:08.067Z",
    "dateUpdated": "2026-08-19T17:30:07.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-28381 (GCVE-0-2026-28381)

Vulnerability from nvd – Published: 2026-06-22 13:20 – Updated: 2026-06-24 15:58

Title

Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

Summary

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 15:43 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Snowflake Datasource	Affected: 1.14.7 , ≤ 1.14.12 (semver)

Date Public

2026-05-15 17:00

Credits

stargravy (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:43:02.758856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:58:25.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Datasource",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "1.14.12",
              "status": "affected",
              "version": "1.14.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "stargravy (Researcher)"
        }
      ],
      "datePublic": "2026-05-15T17:00:39.039Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T13:20:29.440Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-28381"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-28381",
    "datePublished": "2026-06-22T13:20:29.440Z",
    "dateReserved": "2026-02-27T07:16:12.218Z",
    "dateUpdated": "2026-06-24T15:58:25.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10601 (GCVE-0-2026-10601)

Vulnerability from nvd – Published: 2026-06-22 13:18 – Updated: 2026-08-19 17:30

Title

Path traversal in the Tempo and Loki data source plugins

Summary

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 15:44 UTC

CWE

CWE-22
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

homb (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10601",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:44:03.006985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:54:19.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "homb (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T17:30:14.483Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-10601"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Path traversal in the Tempo and Loki data source plugins",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-10601",
    "datePublished": "2026-06-22T13:18:31.531Z",
    "dateReserved": "2026-06-02T09:57:26.570Z",
    "dateUpdated": "2026-08-19T17:30:14.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

294 vulnerabilities by grafana

CVE-2026-17183 (GCVE-0-2026-17183)

CVE-2026-11817 (GCVE-0-2026-11817)

CVE-2026-19516 (GCVE-0-2026-19516)

CVE-2026-9765 (GCVE-0-2026-9765)

CVE-2026-21723 (GCVE-0-2026-21723)

CVE-2026-21729 (GCVE-0-2026-21729)

CVE-2026-15583 (GCVE-0-2026-15583)

CVE-2026-8595 (GCVE-0-2026-8595)

CVE-2026-8609 (GCVE-0-2026-8609)

CVE-2026-33382 (GCVE-0-2026-33382)

CVE-2026-28378 (GCVE-0-2026-28378)

CVE-2026-42127 (GCVE-0-2026-42127)

CVE-2026-28381 (GCVE-0-2026-28381)

CVE-2026-9029 (GCVE-0-2026-9029)

CVE-2026-10601 (GCVE-0-2026-10601)

CVE-2026-11817 (GCVE-0-2026-11817)

CVE-2026-19516 (GCVE-0-2026-19516)

CVE-2026-9765 (GCVE-0-2026-9765)

CVE-2026-21723 (GCVE-0-2026-21723)

CVE-2026-21729 (GCVE-0-2026-21729)

CVE-2026-15583 (GCVE-0-2026-15583)

CVE-2026-8609 (GCVE-0-2026-8609)

CVE-2026-8595 (GCVE-0-2026-8595)

CVE-2026-33382 (GCVE-0-2026-33382)

CVE-2026-28378 (GCVE-0-2026-28378)

CVE-2026-42127 (GCVE-0-2026-42127)

CVE-2026-9029 (GCVE-0-2026-9029)

CVE-2026-42129 (GCVE-0-2026-42129)

CVE-2026-28381 (GCVE-0-2026-28381)

CVE-2026-10601 (GCVE-0-2026-10601)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

294 vulnerabilities by grafana

CVE-2026-17183 (GCVE-0-2026-17183)

CVE-2026-11817 (GCVE-0-2026-11817)

CVE-2026-19516 (GCVE-0-2026-19516)

CVE-2026-9765 (GCVE-0-2026-9765)

CVE-2026-21723 (GCVE-0-2026-21723)

CVE-2026-21729 (GCVE-0-2026-21729)

CVE-2026-15583 (GCVE-0-2026-15583)

CVE-2026-8595 (GCVE-0-2026-8595)

CVE-2026-8609 (GCVE-0-2026-8609)

CVE-2026-33382 (GCVE-0-2026-33382)

CVE-2026-28378 (GCVE-0-2026-28378)

CVE-2026-42127 (GCVE-0-2026-42127)

CVE-2026-28381 (GCVE-0-2026-28381)

CVE-2026-9029 (GCVE-0-2026-9029)

CVE-2026-10601 (GCVE-0-2026-10601)

CVE-2026-11817 (GCVE-0-2026-11817)

CVE-2026-19516 (GCVE-0-2026-19516)

CVE-2026-9765 (GCVE-0-2026-9765)

CVE-2026-21723 (GCVE-0-2026-21723)

CVE-2026-21729 (GCVE-0-2026-21729)

CVE-2026-15583 (GCVE-0-2026-15583)

CVE-2026-8609 (GCVE-0-2026-8609)

CVE-2026-8595 (GCVE-0-2026-8595)

CVE-2026-33382 (GCVE-0-2026-33382)

CVE-2026-28378 (GCVE-0-2026-28378)

CVE-2026-42127 (GCVE-0-2026-42127)

CVE-2026-9029 (GCVE-0-2026-9029)

CVE-2026-42129 (GCVE-0-2026-42129)

CVE-2026-28381 (GCVE-0-2026-28381)

CVE-2026-10601 (GCVE-0-2026-10601)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.