Summary
Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
Product
Grafana ist eine Analyse- und Visualisierungssoftware.
Vulnerabilities 11
-
High 7.1
Cross-instance user impersonation through image renderer JWTs
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This a…
-
High 7.1
Privilege escalation through folder move in the folders API
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move AP…
-
High 7.1
Folder permission bypass in the Git Sync repository files API
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned da…
-
Medium 6.5
Memory exhaustion denial of service in SQL Expressions
A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).
-
Medium 6.5
Path traversal in Git Sync delete and move jobs
A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local files…
-
Medium 6.5
Folder authorization bypass in the Git Sync provisioning files API
A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).
-
Medium 6.5
Authorization bypass in the Git Sync provisioning jobs API
A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorizati…
-
Medium 6.3
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server wi…
-
Medium 5.5
Git Sync connections send credentials to unvalidated server URLs
A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private…
-
Medium 5.3
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other …
-
Medium 4.3
Team preferences RBAC bypass through the set-home-dash endpoint
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their ch…
Revision history
-
#1
Initiale Fassung
References
-
Grafana Security Advisories vom 2026-11-12
https://grafana.com/security/security-advisories/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-14242/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-102589/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-13721/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-111024/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-110289/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-107509/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-110992/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-111000/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-106472/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-82014/
-
Grafana Security Advisory vom 2026-11-12
https://grafana.com/security/security-advisories/cve-2026-107365/