Skip to content
OpenAdvisories
Critical WID-SEC-2026-4237 4 CVEs

Grafana: Mehrere Schwachstellen

Published Oct 28, 2026 · Updated Nov 11, 2026 · Revision 4 · de

Vendor: Grafana Vendor: Red Hat Product: Enterprise Linux Product: Grafana Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Denial of Service Attacken auszuführen, oder Informationen auszulesen.

Product

Grafana ist eine Analyse- und Visualisierungssoftware.

Vulnerabilities 4

  • High 8.9
    CVE-2026-103506

    SSO settings authorization bypass

    An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu
  • High 7.7
    CVE-2026-100105 Public exploit

    Alerting contact point authorization bypass via schema downgrade

    A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • High 7.7
    CVE-2026-88967

    Azure Monitor access token disclosure via SSRF

    A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi
  • Medium 6.5
    CVE-2026-88858

    Server-side expression parser denial of service

    A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Produktversion angepasst

  4. #1

    Initiale Fassung

References