Security

Security Advisories

Showing 24 results, page 1 of 6

Published CVE records
CVESeverity (CVSS)Advisory Title
CVE-2026-13719Medium (4.3)Alert rules in restricted folders disclosed via the alert rules list API
CVE-2026-13720Medium (5.4)Editor can forge file-provisioning provenance on dashboards via the dashboard API
CVE-2026-81842Medium (4.3)Library panel can be moved into a folder without library panel create permission
CVE-2026-81841Medium (5.3)Paused shared dashboard access tokens still expose data source configuration
CVE-2026-76154High (7.3)Geomap MapLibre XSS
CVE-2026-15815High (8.8)Grafana Plugin Extraction Zip Slip
CVE-2026-12704Medium (6.8)SAML assertion replay via skipped InResponseTo validation
CVE-2026-14199High (7.1)Session takeover via Auth Proxy cache key collision
CVE-2026-19475Medium (6.5)SQL Data Source Plugin: OOM DoS via $__timeGroup macro
CVE-2026-19854Medium (6.1)clickhouse-datasource silently drops TLS over PDC
CVE-2026-75889High (7.7)Grafana Alloy: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
CVE-2026-19197Medium (6.3)Broken access control in dashboard snapshots
CVE-2026-17183High (7.1)Grafana Alerting: Datasource query authorization bypass via spoofed queryType
CVE-2026-17033Medium (6.8)Grafana OSS: Stored XSS via external Alertmanager generatorURL
CVE-2026-19516Critical (9.1)Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request)
CVE-2026-21723Medium (5.3)DoS Vulnerability in Templates Test endpoint
CVE-2026-11817Medium (5.3)SearchUsersPermissions returns cross-org users
CVE-2026-15583High (8.6)Grafana MCP server-side request forgery via X-Grafana-URL header
CVE-2026-21729Medium (7.5)Loki detected_fields query limits results in unbounded memory allocation
CVE-2026-11769Medium (6.4)Operator - Namespaced User Path Traversal
CVE-2026-33382High (7.5)Grafana denial of service via oversized request bodies (web.Bind)
CVE-2026-42129High (7.7)Path traversal in the Loki data source leads to internal information disclosure
CVE-2026-10601Medium (5.4)Path traversal in the Tempo and Loki data source plugins
CVE-2026-8609Medium (5.3)Pre-authentication denial of service in the OAuth login route

Security Advisories | Grafana Labs