Security

Security Advisories

Subscribe via RSS

Showing 24 results, page 1 of 7

Published CVE records
CVESeverity (CVSS)Advisory Title
CVE-2026-14242Medium (6.5)Authorization bypass in the Git Sync provisioning jobs API
CVE-2026-102589High (7.1)Cross-instance user impersonation through image renderer JWTs
CVE-2026-106475High (7.1)Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials
CVE-2026-13721Medium (6.5)Folder authorization bypass in the Git Sync provisioning files API
CVE-2026-111024High (7.1)Folder permission bypass in the Git Sync repository files API
CVE-2026-110289Medium (5.5)Git Sync connections send credentials to unvalidated server URLs
CVE-2026-81843Medium (6.5)Memory exhaustion denial of service in Elasticsearch data source index patterns
CVE-2026-107509Medium (6.5)Memory exhaustion denial of service in SQL Expressions
CVE-2026-110992Medium (6.5)Path traversal in Git Sync delete and move jobs
CVE-2026-111000High (7.1)Privilege escalation through folder move in the folders API
CVE-2026-106472Medium (6.3)Server-side request forgery in the Prometheus data source resource API
CVE-2026-82014Medium (4.3)Team preferences RBAC bypass through the set-home-dash endpoint
CVE-2026-107365Medium (5.3)Unintended API access through the Google Cloud Monitoring data source resource proxy
CVE-2026-100105High (7.7)Alerting contact point authorization bypass via schema downgrade
CVE-2026-88967High (7.7)Azure Monitor access token disclosure via SSRF
CVE-2026-88858Medium (6.5)Server-side expression parser denial of service
CVE-2026-103506High (8.9)SSO settings authorization bypass
CVE-2026-93294Medium (6.3)Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
CVE-2026-92539Medium (6.7)Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
CVE-2026-15577Medium (6.5)Git Sync connection configuration can be modified with read-only access
CVE-2026-95502Medium (5.3)Git Sync memory exhaustion via a malicious Git server
CVE-2026-33374Medium (6.5)Unbounded memory allocation in the Prometheus rule conversion API
CVE-2026-89039Medium (6.5)Arbitrary file read via the convert_playwright_script prompt in mcp-k6
CVE-2026-13719Medium (4.3)Alert rules in restricted folders disclosed via the alert rules list API

Security Advisories | Grafana Labs