Search
Find a vulnerability
Search criteria
349 vulnerabilities by grafana
CVE-2026-81938 (GCVE-0-2026-81938)
Vulnerability from nvd – Published: 2026-11-02 18:23 – Updated: 2026-11-02 19:06
VLAI
EPSS
VEX
Title
Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir
Summary
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.
Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:06 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Enterprise Metrics (GEM) |
Affected:
2.11.0 , ≤ 2.16.2
(semver)
Affected: 2.17.0 , < 2.17.20 (semver) |
|
| Grafana | Grafana Mimir |
Affected:
3.0.4 , < 3.1.7
(semver)
Affected: 3.2.0 , < 3.2.2 (semver) |
Date Public
2026-09-27 19:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:06:44.198911Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:06:58.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enterprise Metrics (GEM)",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "2.16.2",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
},
{
"lessThan": "2.17.20",
"status": "affected",
"version": "2.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Mimir",
"vendor": "Grafana",
"versions": [
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.0.4",
"versionType": "semver"
},
{
"lessThan": "3.2.2",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arang"
}
],
"datePublic": "2026-09-27T19:29:04.693Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana Mimir\u0027s Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.\u003cname\u003e.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.\n\nExploitation requires permission to write the tenant\u0027s Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:23:43.604Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-81938"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-81938",
"datePublished": "2026-11-02T18:23:43.604Z",
"dateReserved": "2026-08-27T19:29:04.581Z",
"dateUpdated": "2026-11-02T19:06:58.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79656 (GCVE-0-2026-79656)
Vulnerability from nvd – Published: 2026-10-28 17:23 – Updated: 2026-10-28 17:23
VLAI
EPSS
VEX
Title
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
Summary
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
Severity
6 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.11 (semver) Affected: 13.0.0 , < 13.0.9 (semver) Affected: 13.1.0 , < 13.1.6 (semver) Affected: 13.2.0 , < 13.2.2 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.11 (semver) Affected: 13.0.0 , < 13.0.9 (semver) Affected: 13.1.0 , < 13.1.6 (semver) Affected: 13.2.0 , < 13.2.2 (semver) |
Date Public
2026-09-15 12:21
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.11",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.9",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.6",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.2",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.11",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.9",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.6",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.2",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Baptiste Roux (baprx)"
}
],
"datePublic": "2026-09-15T12:21:32.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with read access to Grafana\u0027s server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T17:23:44.625Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-79656"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-79656",
"datePublished": "2026-10-28T17:23:44.625Z",
"dateReserved": "2026-08-25T11:00:05.466Z",
"dateUpdated": "2026-10-28T17:23:44.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88967 (GCVE-0-2026-88967)
Vulnerability from nvd – Published: 2026-10-28 16:49 – Updated: 2026-10-28 16:49
VLAI
EPSS
VEX
Title
Azure Monitor access token disclosure via SSRF
Summary
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Severity
7.7 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
10.0.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
10.0.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "rathina (Researcher)"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source\u0027s Azure access token (server-side request forgery)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:49:57.393Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-88967"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Azure Monitor access token disclosure via SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-88967",
"datePublished": "2026-10-28T16:49:57.393Z",
"dateReserved": "2026-09-10T16:01:52.880Z",
"dateUpdated": "2026-10-28T16:49:57.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88858 (GCVE-0-2026-88858)
Vulnerability from nvd – Published: 2026-10-28 16:50 – Updated: 2026-10-28 16:50
VLAI
EPSS
VEX
Title
Server-side expression parser denial of service
Summary
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Severity
6.5 (Medium)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
7.4.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
7.4.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mukul Goyal"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:50:17.291Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-88858"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Server-side expression parser denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-88858",
"datePublished": "2026-10-28T16:50:17.291Z",
"dateReserved": "2026-09-10T10:30:46.142Z",
"dateUpdated": "2026-10-28T16:50:17.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103506 (GCVE-0-2026-103506)
Vulnerability from nvd – Published: 2026-10-28 16:50 – Updated: 2026-10-28 16:50
VLAI
EPSS
VEX
Title
SSO settings authorization bypass
Summary
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
13.2.0 , ≤ 13.2.4
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.2.0 , ≤ 13.2.4
(semver)
|
Date Public
2026-10-27 11:34
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kazuki-hanai"
}
],
"datePublic": "2026-10-27T11:34:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:50:30.111Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-103506"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "SSO settings authorization bypass"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-103506",
"datePublished": "2026-10-28T16:50:30.111Z",
"dateReserved": "2026-09-30T17:37:32.552Z",
"dateUpdated": "2026-10-28T16:50:30.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100105 (GCVE-0-2026-100105)
Vulnerability from nvd – Published: 2026-10-28 16:48 – Updated: 2026-10-28 16:48
VLAI
EPSS
VEX
Title
Alerting contact point authorization bypass via schema downgrade
Summary
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Severity
7.7 (High)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.4.0 , ≤ 12.4.13
(semver)
Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.4.0 , ≤ 12.4.13
(semver)
Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 11:08
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-27T11:08:50.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point\u0027s destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:48:58.880Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-100105"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Alerting contact point authorization bypass via schema downgrade"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-100105",
"datePublished": "2026-10-28T16:48:58.880Z",
"dateReserved": "2026-09-25T11:03:39.683Z",
"dateUpdated": "2026-10-28T16:48:58.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16491 (GCVE-0-2026-16491)
Vulnerability from nvd – Published: 2026-10-27 17:21 – Updated: 2026-10-27 17:21
VLAI
EPSS
VEX
Title
CVE-2026-16491 CVE Record
Summary
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Severity
6.5 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , ≤ 13.0.4
(semver)
Affected: 13.1.0 , ≤ 13.1.1 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , ≤ 13.1.0
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.0.0 , ≤ 13.1.1
(semver)
|
Date Public
2026-07-21 16:02
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.4",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.1",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"macOS"
],
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.0",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-07-21T16:02:26.865Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u2019s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.\n\nThis could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:21:38.467Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-16491"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "CVE-2026-16491 CVE Record"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-16491",
"datePublished": "2026-10-27T17:21:38.467Z",
"dateReserved": "2026-07-21T16:02:26.000Z",
"dateUpdated": "2026-10-27T17:21:38.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92539 (GCVE-0-2026-92539)
Vulnerability from nvd – Published: 2026-10-20 16:55 – Updated: 2026-10-20 18:08
VLAI
EPSS
VEX
Title
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Summary
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:22 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
11.6.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 10:21
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:22:31.577037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:08:00.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T10:21:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:55:17.875Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-92539"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-92539",
"datePublished": "2026-10-20T16:55:17.875Z",
"dateReserved": "2026-09-16T12:55:31.889Z",
"dateUpdated": "2026-10-20T18:08:00.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9703 (GCVE-0-2026-9703)
Vulnerability from nvd – Published: 2026-10-15 14:02 – Updated: 2026-10-16 18:52
VLAI
EPSS
VEX
Title
Viewer role can create, modify and delete Loki alerting rules
Summary
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.
Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:52 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
8.0.0 , ≤ 11.5.10
(semver)
Affected: 11.6.0 , ≤ 11.6.16 (semver) Affected: 12.0.0 , ≤ 12.1.10 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver) Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.3.0 , ≤ 12.3.8
(semver)
Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 8.0.0 , ≤ 12.3.0 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) |
Date Public
2026-06-27 13:19
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:22.846867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:52:39.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.5.10",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.0",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-06-27T13:19:00.599Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u0027s data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana\u0027s data source proxy; Loki itself is not vulnerable and does not need to be patched."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:02:00.146Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-9703"
}
],
"source": {
"discovery": "PEN_TEST"
},
"title": "Viewer role can create, modify and delete Loki alerting rules"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-9703",
"datePublished": "2026-10-15T14:02:00.146Z",
"dateReserved": "2026-05-27T12:38:34.129Z",
"dateUpdated": "2026-10-16T18:52:39.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95502 (GCVE-0-2026-95502)
Vulnerability from nvd – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Git Sync memory exhaustion via a malicious Git server
Summary
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Nanogit |
Affected:
0 , < 1.7.0
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.0.0 , < 13.0.11
(semver)
Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , < 13.0.11
(semver)
Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:57.638487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nanogit",
"vendor": "Grafana",
"versions": [
{
"lessThan": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Git server that Grafana\u0027s Git Sync (provisioning) is configured to use can exhaust Grafana\u0027s memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.670Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-95502"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Git Sync memory exhaustion via a malicious Git server"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-95502",
"datePublished": "2026-10-13T17:05:49.670Z",
"dateReserved": "2026-09-22T06:41:34.015Z",
"dateUpdated": "2026-10-13T19:31:30.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93294 (GCVE-0-2026-93294)
Vulnerability from nvd – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Summary
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
8.1.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
8.1.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:28.085923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source\u0027s Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.715Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-93294"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-93294",
"datePublished": "2026-10-13T17:05:49.715Z",
"dateReserved": "2026-09-17T16:21:17.776Z",
"dateUpdated": "2026-10-13T19:31:30.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33374 (GCVE-0-2026-33374)
Vulnerability from nvd – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:21
VLAI
EPSS
VEX
Title
Unbounded memory allocation in the Prometheus rule conversion API
Summary
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:25 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.0.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.0.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:25:44.714882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:21:25.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.782Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33374"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Unbounded memory allocation in the Prometheus rule conversion API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33374",
"datePublished": "2026-10-13T17:05:49.782Z",
"dateReserved": "2026-03-19T07:55:06.977Z",
"dateUpdated": "2026-10-13T19:21:25.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15577 (GCVE-0-2026-15577)
Vulnerability from nvd – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Git Sync connection configuration can be modified with read-only access
Summary
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.4.0 , < 12.4.13
(semver)
Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.4.0 , < 12.4.13
(semver)
Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:14.086881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection\u0027s configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.743Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-15577"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Git Sync connection configuration can be modified with read-only access"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-15577",
"datePublished": "2026-10-13T17:05:49.743Z",
"dateReserved": "2026-07-13T09:25:08.159Z",
"dateUpdated": "2026-10-13T19:31:30.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89039 (GCVE-0-2026-89039)
Vulnerability from nvd – Published: 2026-10-05 14:52 – Updated: 2026-10-05 19:36
VLAI
EPSS
VEX
Title
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Summary
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 15:14 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
Date Public
2026-10-05 14:40
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T15:14:33.272676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:16:20.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mcp-k6",
"vendor": "Grafana",
"versions": [
{
"lessThan": "0.7.0",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "bebold6133 (Researcher)"
}
],
"datePublic": "2026-10-05T14:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user\u0027s home directory (path traversal). The working-directory restriction applied to \u0027@\u0027-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:36:42.166Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-89039"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Arbitrary file read via the convert_playwright_script prompt in mcp-k6"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-89039",
"datePublished": "2026-10-05T14:52:41.097Z",
"dateReserved": "2026-09-10T16:41:38.640Z",
"dateUpdated": "2026-10-05T19:36:42.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13720 (GCVE-0-2026-13720)
Vulnerability from nvd – Published: 2026-09-30 11:06 – Updated: 2026-09-30 15:28
VLAI
EPSS
VEX
Title
Editor can forge file-provisioning provenance on dashboards via the dashboard API
Summary
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 13:55 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
12.0.0 , ≤ 12.0.10
(semver)
Affected: 12.1.0 , ≤ 12.1.10 (semver) Affected: 12.2.0 , ≤ 12.2.11 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.12 (semver) Affected: 13.0.0 , < 13.0.10 (semver) Affected: 13.1.0 , < 13.1.7 (semver) Affected: 13.2.0 , < 13.2.3 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
12.0.0 , ≤ 12.0.10
(semver)
Affected: 12.1.0 , ≤ 12.1.10 (semver) Affected: 12.2.0 , ≤ 12.2.11 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , < 12.4.12 (semver) Affected: 13.0.0 , < 13.0.10 (semver) Affected: 13.1.0 , < 13.1.7 (semver) Affected: 13.2.0 , < 13.2.3 (semver) |
Date Public
2026-09-29 07:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T13:55:59.494551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:28:07.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.11",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.12",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.7",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.3",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.11",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.12",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.7",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.3",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arang (Researcher)"
}
],
"datePublic": "2026-09-29T07:44:02.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T11:06:38.177Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-13720"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Editor can forge file-provisioning provenance on dashboards via the dashboard API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-13720",
"datePublished": "2026-09-30T11:06:38.177Z",
"dateReserved": "2026-06-29T14:11:02.739Z",
"dateUpdated": "2026-09-30T15:28:07.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13719 (GCVE-0-2026-13719)
Vulnerability from nvd – Published: 2026-09-30 11:06 – Updated: 2026-09-30 14:29
VLAI
EPSS
VEX
Title
Alert rules in restricted folders disclosed via the alert rules list API
Summary
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:29 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.3.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.12 (semver) Affected: 13.0.0 , < 13.0.10 (semver) Affected: 13.1.0 , < 13.1.7 (semver) Affected: 13.2.0 , < 13.2.3 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.3.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.12 (semver) Affected: 13.0.0 , < 13.0.10 (semver) Affected: 13.1.0 , < 13.1.7 (semver) Affected: 13.2.0 , < 13.2.3 (semver) |
Date Public
2026-09-29 07:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13719",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:29:01.284869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:29:13.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.12",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.7",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.3",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThan": "12.4.12",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.10",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.7",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.3",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mon3m"
}
],
"datePublic": "2026-09-29T07:44:02.000Z",
"descriptions": [
{
"lang": "en",
"value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:05:14.113Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-13719"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Alert rules in restricted folders disclosed via the alert rules list API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-13719",
"datePublished": "2026-09-30T11:06:38.172Z",
"dateReserved": "2026-06-29T14:10:37.534Z",
"dateUpdated": "2026-09-30T14:29:13.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81938 (GCVE-0-2026-81938)
Vulnerability from cvelistv5 – Published: 2026-11-02 18:23 – Updated: 2026-11-02 19:06
VLAI
EPSS
VEX
Title
Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir
Summary
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.
Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:06 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Enterprise Metrics (GEM) |
Affected:
2.11.0 , ≤ 2.16.2
(semver)
Affected: 2.17.0 , < 2.17.20 (semver) |
|
| Grafana | Grafana Mimir |
Affected:
3.0.4 , < 3.1.7
(semver)
Affected: 3.2.0 , < 3.2.2 (semver) |
Date Public
2026-09-27 19:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:06:44.198911Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:06:58.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enterprise Metrics (GEM)",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "2.16.2",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
},
{
"lessThan": "2.17.20",
"status": "affected",
"version": "2.17.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Mimir",
"vendor": "Grafana",
"versions": [
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.0.4",
"versionType": "semver"
},
{
"lessThan": "3.2.2",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "arang"
}
],
"datePublic": "2026-09-27T19:29:04.693Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana Mimir\u0027s Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.\u003cname\u003e.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.\n\nExploitation requires permission to write the tenant\u0027s Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:23:43.604Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-81938"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-81938",
"datePublished": "2026-11-02T18:23:43.604Z",
"dateReserved": "2026-08-27T19:29:04.581Z",
"dateUpdated": "2026-11-02T19:06:58.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79656 (GCVE-0-2026-79656)
Vulnerability from cvelistv5 – Published: 2026-10-28 17:23 – Updated: 2026-10-28 17:23
VLAI
EPSS
VEX
Title
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
Summary
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
Severity
6 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.11 (semver) Affected: 13.0.0 , < 13.0.9 (semver) Affected: 13.1.0 , < 13.1.6 (semver) Affected: 13.2.0 , < 13.2.2 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.11 (semver) Affected: 13.0.0 , < 13.0.9 (semver) Affected: 13.1.0 , < 13.1.6 (semver) Affected: 13.2.0 , < 13.2.2 (semver) |
Date Public
2026-09-15 12:21
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.11",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.9",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.6",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.2",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "12.4.11",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.9",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.6",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.2",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Baptiste Roux (baprx)"
}
],
"datePublic": "2026-09-15T12:21:32.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with read access to Grafana\u0027s server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T17:23:44.625Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-79656"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-79656",
"datePublished": "2026-10-28T17:23:44.625Z",
"dateReserved": "2026-08-25T11:00:05.466Z",
"dateUpdated": "2026-10-28T17:23:44.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103506 (GCVE-0-2026-103506)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:50 – Updated: 2026-10-28 16:50
VLAI
EPSS
VEX
Title
SSO settings authorization bypass
Summary
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
13.2.0 , ≤ 13.2.4
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.2.0 , ≤ 13.2.4
(semver)
|
Date Public
2026-10-27 11:34
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kazuki-hanai"
}
],
"datePublic": "2026-10-27T11:34:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:50:30.111Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-103506"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "SSO settings authorization bypass"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-103506",
"datePublished": "2026-10-28T16:50:30.111Z",
"dateReserved": "2026-09-30T17:37:32.552Z",
"dateUpdated": "2026-10-28T16:50:30.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88858 (GCVE-0-2026-88858)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:50 – Updated: 2026-10-28 16:50
VLAI
EPSS
VEX
Title
Server-side expression parser denial of service
Summary
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Severity
6.5 (Medium)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana OSS |
Affected:
7.4.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
7.4.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mukul Goyal"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:50:17.291Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-88858"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Server-side expression parser denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-88858",
"datePublished": "2026-10-28T16:50:17.291Z",
"dateReserved": "2026-09-10T10:30:46.142Z",
"dateUpdated": "2026-10-28T16:50:17.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88967 (GCVE-0-2026-88967)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:49 – Updated: 2026-10-28 16:49
VLAI
EPSS
VEX
Title
Azure Monitor access token disclosure via SSRF
Summary
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Severity
7.7 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
10.0.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
10.0.0 , ≤ 11.6.16
(semver)
Affected: 12.0.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.11 (semver) Affected: 12.4.0 , ≤ 12.4.13 (semver) Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "rathina (Researcher)"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source\u0027s Azure access token (server-side request forgery)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:49:57.393Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-88967"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Azure Monitor access token disclosure via SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-88967",
"datePublished": "2026-10-28T16:49:57.393Z",
"dateReserved": "2026-09-10T16:01:52.880Z",
"dateUpdated": "2026-10-28T16:49:57.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100105 (GCVE-0-2026-100105)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:48 – Updated: 2026-10-28 16:48
VLAI
EPSS
VEX
Title
Alerting contact point authorization bypass via schema downgrade
Summary
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Severity
7.7 (High)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.4.0 , ≤ 12.4.13
(semver)
Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.4.0 , ≤ 12.4.13
(semver)
Affected: 13.0.0 , ≤ 13.0.11 (semver) Affected: 13.1.0 , ≤ 13.1.8 (semver) Affected: 13.2.0 , ≤ 13.2.4 (semver) |
Date Public
2026-10-27 11:08
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-27T11:08:50.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point\u0027s destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:48:58.880Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-100105"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Alerting contact point authorization bypass via schema downgrade"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-100105",
"datePublished": "2026-10-28T16:48:58.880Z",
"dateReserved": "2026-09-25T11:03:39.683Z",
"dateUpdated": "2026-10-28T16:48:58.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16491 (GCVE-0-2026-16491)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:21 – Updated: 2026-10-27 17:21
VLAI
EPSS
VEX
Title
CVE-2026-16491 CVE Record
Summary
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Severity
6.5 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , ≤ 13.0.4
(semver)
Affected: 13.1.0 , ≤ 13.1.1 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , ≤ 13.1.0
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.0.0 , ≤ 13.1.1
(semver)
|
Date Public
2026-07-21 16:02
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.0.4",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.1.1",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"macOS"
],
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.0",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "13.1.1",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-07-21T16:02:26.865Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u2019s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.\n\nThis could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:21:38.467Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-16491"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "CVE-2026-16491 CVE Record"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-16491",
"datePublished": "2026-10-27T17:21:38.467Z",
"dateReserved": "2026-07-21T16:02:26.000Z",
"dateUpdated": "2026-10-27T17:21:38.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92539 (GCVE-0-2026-92539)
Vulnerability from cvelistv5 – Published: 2026-10-20 16:55 – Updated: 2026-10-20 18:08
VLAI
EPSS
VEX
Title
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Summary
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:22 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
11.6.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 10:21
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:22:31.577037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:08:00.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T10:21:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:55:17.875Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-92539"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-92539",
"datePublished": "2026-10-20T16:55:17.875Z",
"dateReserved": "2026-09-16T12:55:31.889Z",
"dateUpdated": "2026-10-20T18:08:00.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9703 (GCVE-0-2026-9703)
Vulnerability from cvelistv5 – Published: 2026-10-15 14:02 – Updated: 2026-10-16 18:52
VLAI
EPSS
VEX
Title
Viewer role can create, modify and delete Loki alerting rules
Summary
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.
Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:52 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
8.0.0 , ≤ 11.5.10
(semver)
Affected: 11.6.0 , ≤ 11.6.16 (semver) Affected: 12.0.0 , ≤ 12.1.10 (semver) Affected: 12.2.0 , ≤ 12.2.10 (semver) Affected: 12.3.0 , ≤ 12.3.8 (semver) Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.3.0 , ≤ 12.3.8
(semver)
Affected: 12.4.0 , ≤ 12.4.5 (semver) Affected: 8.0.0 , ≤ 12.3.0 (semver) Affected: 13.0.0 , ≤ 13.0.3 (semver) |
Date Public
2026-06-27 13:19
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:22.846867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:52:39.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "11.5.10",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.6.16",
"status": "affected",
"version": "11.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.10",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.2.10",
"status": "affected",
"version": "12.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.8",
"status": "affected",
"version": "12.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.4.5",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.3.0",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "13.0.3",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-06-27T13:19:00.599Z",
"descriptions": [
{
"lang": "en",
"value": "Grafana\u0027s data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana\u0027s data source proxy; Loki itself is not vulnerable and does not need to be patched."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:02:00.146Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-9703"
}
],
"source": {
"discovery": "PEN_TEST"
},
"title": "Viewer role can create, modify and delete Loki alerting rules"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-9703",
"datePublished": "2026-10-15T14:02:00.146Z",
"dateReserved": "2026-05-27T12:38:34.129Z",
"dateUpdated": "2026-10-16T18:52:39.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33374 (GCVE-0-2026-33374)
Vulnerability from cvelistv5 – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:21
VLAI
EPSS
VEX
Title
Unbounded memory allocation in the Prometheus rule conversion API
Summary
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:25 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.0.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.0.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:25:44.714882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:21:25.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.782Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-33374"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Unbounded memory allocation in the Prometheus rule conversion API"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-33374",
"datePublished": "2026-10-13T17:05:49.782Z",
"dateReserved": "2026-03-19T07:55:06.977Z",
"dateUpdated": "2026-10-13T19:21:25.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15577 (GCVE-0-2026-15577)
Vulnerability from cvelistv5 – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Git Sync connection configuration can be modified with read-only access
Summary
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
12.4.0 , < 12.4.13
(semver)
Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
12.4.0 , < 12.4.13
(semver)
Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:14.086881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection\u0027s configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.743Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-15577"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Git Sync connection configuration can be modified with read-only access"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-15577",
"datePublished": "2026-10-13T17:05:49.743Z",
"dateReserved": "2026-07-13T09:25:08.159Z",
"dateUpdated": "2026-10-13T19:31:30.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93294 (GCVE-0-2026-93294)
Vulnerability from cvelistv5 – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Summary
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Grafana Enterprise |
Affected:
8.1.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana OSS |
Affected:
8.1.0 , ≤ 12.3.11
(semver)
Affected: 12.4.0 , < 12.4.13 (semver) Affected: 13.0.0 , < 13.0.11 (semver) Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:28.085923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThanOrEqual": "12.3.11",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "12.4.13",
"status": "affected",
"version": "12.4.0",
"versionType": "semver"
},
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source\u0027s Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.715Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-93294"
}
],
"source": {
"discovery": "EXTERNAL_REPORT"
},
"title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-93294",
"datePublished": "2026-10-13T17:05:49.715Z",
"dateReserved": "2026-09-17T16:21:17.776Z",
"dateUpdated": "2026-10-13T19:31:30.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95502 (GCVE-0-2026-95502)
Vulnerability from cvelistv5 – Published: 2026-10-13 17:05 – Updated: 2026-10-13 19:31
VLAI
EPSS
VEX
Title
Git Sync memory exhaustion via a malicious Git server
Summary
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:26 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana | Nanogit |
Affected:
0 , < 1.7.0
(semver)
|
|
| Grafana | Grafana OSS |
Affected:
13.0.0 , < 13.0.11
(semver)
Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
|
| Grafana | Grafana Enterprise |
Affected:
13.0.0 , < 13.0.11
(semver)
Affected: 13.1.0 , < 13.1.8 (semver) Affected: 13.2.0 , < 13.2.4 (semver) |
Date Public
2026-10-13 11:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:26:57.638487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:31:30.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nanogit",
"vendor": "Grafana",
"versions": [
{
"lessThan": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana OSS",
"vendor": "Grafana",
"versions": [
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Grafana Enterprise",
"vendor": "Grafana",
"versions": [
{
"lessThan": "13.0.11",
"status": "affected",
"version": "13.0.0",
"versionType": "semver"
},
{
"lessThan": "13.1.8",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
},
{
"lessThan": "13.2.4",
"status": "affected",
"version": "13.2.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T11:41:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Git server that Grafana\u0027s Git Sync (provisioning) is configured to use can exhaust Grafana\u0027s memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:05:49.670Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-95502"
}
],
"source": {
"discovery": "INTERNAL_FINDING"
},
"title": "Git Sync memory exhaustion via a malicious Git server"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-95502",
"datePublished": "2026-10-13T17:05:49.670Z",
"dateReserved": "2026-09-22T06:41:34.015Z",
"dateUpdated": "2026-10-13T19:31:30.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89039 (GCVE-0-2026-89039)
Vulnerability from cvelistv5 – Published: 2026-10-05 14:52 – Updated: 2026-10-05 19:36
VLAI
EPSS
VEX
Title
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Summary
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 15:14 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
Impacted products
Date Public
2026-10-05 14:40
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T15:14:33.272676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:16:20.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mcp-k6",
"vendor": "Grafana",
"versions": [
{
"lessThan": "0.7.0",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "bebold6133 (Researcher)"
}
],
"datePublic": "2026-10-05T14:40:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user\u0027s home directory (path traversal). The working-directory restriction applied to \u0027@\u0027-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:36:42.166Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2026-89039"
}
],
"source": {
"discovery": "BUG_BOUNTY"
},
"title": "Arbitrary file read via the convert_playwright_script prompt in mcp-k6"
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2026-89039",
"datePublished": "2026-10-05T14:52:41.097Z",
"dateReserved": "2026-09-10T16:41:38.640Z",
"dateUpdated": "2026-10-05T19:36:42.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}