By vendor
Grafana vulnerabilities
Known CVEs affecting Grafana products, prioritized by severity, with SEC.co remediation and detection guidance.
10 published vulnerabilities
- CVE-2026-11769HIGH 8.8
The Grafana Operator, a popular tool for managing Grafana instances in Kubernetes environments, contains a security flaw that allows attackers with dashboard creation permissions to steal the operator's service account token. The vulnerability stems from the operator's support for jsonnet templating—a data definition language evaluated within the operator's pod context—which can be exploited to access sensitive credentials. This affects all versions up to and including 5.23, with version 5.24.0 providing the fix.
- CVE-2026-42129HIGH 7.7
A vulnerability in Grafana's Loki data source plugin allows users with basic read-only (Viewer) permissions to bypass intended access controls and reach administrative endpoints they should not access. By crafting malicious file paths, an authenticated attacker can retrieve sensitive backend configuration details and internal service information that would normally be restricted to administrators. This is a path traversal flaw—a classic technique for escaping intended directory boundaries.
- CVE-2026-33382HIGH 7.5
Grafana contains a flaw in its API request handling that allows attackers to send extremely large payloads to certain endpoints without proper size validation. Some of these endpoints don't require authentication, making them accessible to unauthenticated users. When large payloads are processed, the application allocates excessive memory, which can eventually exhaust available system resources and crash the Grafana instance, creating a denial of service condition.
- CVE-2026-42127HIGH 7.5
A vulnerability in Grafana's public dashboard query endpoint allows attackers to crash the service by sending extremely large requests without needing any credentials. The vulnerability stems from missing request size validation, which permits an attacker to force the server to allocate unbounded memory until it runs out of resources. This is a straightforward denial-of-service attack that requires only network access to an exposed Grafana instance.
- CVE-2026-9029HIGH 7.3
A vulnerability in Grafana allows users with Editor permissions to inject malicious scripts into map panel settings. When another user views the dashboard, that script runs in their browser, potentially compromising their session, stealing credentials, or performing actions on their behalf. This is a stored attack—the malicious code persists in the dashboard configuration.
- CVE-2026-8595MEDIUM 6.8
An Editor-level user in Grafana can create a dashboard containing a specially crafted table panel with a malicious field name. When other users view that dashboard, the malicious field name executes as JavaScript in their browsers without additional user interaction beyond viewing the dashboard. This is a stored cross-site scripting (XSS) vulnerability—the attack persists in the dashboard artifact itself, making it a reliable vector for compromising viewer sessions.
- CVE-2026-27878MEDIUM 6.5
A vulnerability in Grafana Tempo allows an authenticated user to crash the service by submitting a specially crafted TraceQL query with an extremely large exemplars hint parameter. The Tempo instance will attempt to allocate excessive memory to process the request, eventually running out of memory and becoming unavailable. This is a denial-of-service attack that requires valid credentials to execute.
- CVE-2026-10601MEDIUM 5.4
A vulnerability in Grafana's Tempo and Loki data source plugins allows users with basic Viewer permissions to bypass intended access controls and reach backend endpoints they shouldn't be able to access. By crafting specially designed requests, an authenticated attacker can potentially steal database credentials, extract sensitive internal information, or execute administrative commands on the connected backend system. While the attack requires valid user credentials, the low barrier to entry (Viewer level is a basic permission tier) and the potential exposure of sensitive infrastructure credentials make this a meaningful risk for most organizations.
- CVE-2026-8609MEDIUM 5.3
Grafana has a denial-of-service vulnerability in its OAuth login flow. An unauthenticated attacker can send repeated login attempts with varying parameters, causing the application to leak memory without bound. Eventually, the Grafana instance runs out of memory and crashes, disrupting availability for legitimate users. No authentication is required to trigger this issue, making it accessible to anyone on the network.
- CVE-2026-28378LOW 3.1
A Grafana vulnerability allows an administrator in one organization to delete public dashboards belonging to a different organization. The issue stems from insufficient access controls on the dashboard deletion endpoint, which does not properly verify organizational boundaries. An authenticated org admin can exploit this by crafting requests with another organization's dashboard identifiers to remove their dashboards without authorization.