Summary
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen, Code auszuführen oder Informationen offenzulegen.
Product
Grafana ist eine Analyse- und Visualisierungssoftware.
Vulnerabilities 5
-
Critical 9.1CVE-2026-27876 Public exploit
RCE on Grafana via sqlExpressions
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going …
-
High 7.5
OpenFeature evaluation API reads input data with no bounds
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
-
Medium 6.9
Simplex Incident Manager Clear Test
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire…
-
Medium 6.5
Public dashboards discloses all direct mode datasources
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-s…
-
Medium 6.5
Query resampling can cause unbounded memory allocations
A resample query can be used to trigger out-of-memory crashes in Grafana.
Revision history
-
#9
Referenz(en) aufgenommen: EUVD-2026-64036
-
#8
Neue Updates von Oracle Linux aufgenommen
-
#7
Neue Updates von Oracle Linux aufgenommen
-
#6
Neue Updates von SUSE aufgenommen
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen
-
#3
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Grafana Security Advisory vom 2026-03-29
https://grafana.com/security/security-advisories/cve-2026-28375/
-
Grafana Security Advisory vom 2026-03-29
https://grafana.com/security/security-advisories/cve-2026-27876/
-
Grafana Security Advisory vom 2026-03-29
https://grafana.com/security/security-advisories/cve-2026-27877/
-
Grafana Security Advisory vom 2026-03-29
https://grafana.com/security/security-advisories/cve-2026-27879/
-
Grafana Security Advisory vom 2026-03-29
https://grafana.com/security/security-advisories/cve-2026-27880/
-
Red Hat Security Advisory RHSA-2026:10223 vom 2026-04-24
https://access.redhat.com/errata/RHSA-2026:10223
-
Red Hat Security Advisory RHSA-2026:10226 vom 2026-04-24
https://access.redhat.com/errata/RHSA-2026:10226
-
Rocky Linux Security Advisory RLSA-2026:10226 vom 2026-04-28
https://errata.build.resf.org/RLSA-2026:10226
-
Rocky Linux Security Advisory RLSA-2026:10223 vom 2026-04-28
https://errata.build.resf.org/RLSA-2026:10223
-
Red Hat Security Advisory RHSA-2026:11417 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11417
-
Red Hat Security Advisory RHSA-2026:11416 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11416
-
Red Hat Security Advisory RHSA-2026:19134 vom 2026-05-19
https://access.redhat.com/errata/RHSA-2026:19134
-
Red Hat Security Advisory RHSA-2026:19352 vom 2026-05-20
https://access.redhat.com/errata/RHSA-2026:19352
-
SUSE Security Update SUSE-SU-2026:2258-1 vom 2026-06-03
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026563.html
-
Oracle Linux Security Advisory ELSA-2026-19352 vom 2026-06-24
https://linux.oracle.com/errata/ELSA-2026-19352.html
-
Oracle Linux Security Advisory ELSA-2026-35827 vom 2026-07-17
http://linux.oracle.com/errata/ELSA-2026-35827.html
-
Oracle Linux Security Advisory ELSA-2026-19134 vom 2026-07-17
https://linux.oracle.com/errata/ELSA-2026-19134.html