Skip to content
OpenAdvisories
Medium WID-SEC-2026-3910 4 CVEs

Grafana: Mehrere Schwachstellen

Published Oct 13, 2026 · Updated Oct 19, 2026 · Revision 2 · de-DE

Vendor: Grafana Vendor: Red Hat Product: Enterprise Linux Product: Grafana Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Denial of Service Attacken durchzuführen und auf vertrauliche Informationen zuzugreifen.

Product

Grafana ist eine Analyse- und Visualisierungssoftware.

Vulnerabilities 4

  • Medium 6.5
    CVE-2026-15577

    Git Sync connection configuration can be modified with read-only access

    A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • Medium 6.5
    CVE-2026-33374

    Unbounded memory allocation in the Prometheus rule conversion API

    The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi
  • Medium 6.3
    CVE-2026-93294

    Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

    A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi
  • Medium 5.3
    CVE-2026-95502

    Git Sync memory exhaustion via a malicious Git server

    A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync…

    Grafana Grafana OSS Grafana Enterprise Nanogit Web / CMS

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References