grafana

8 results · Clear filters · Feed

• High 7.7
  CVE-2026-100105 Public exploit

  Alerting contact point authorization bypass via schema downgrade

  A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

  Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  Oct 28, 2026
• Critical 9.1
  CVE-2026-27876 Public exploit

  RCE on Grafana via sqlExpressions

  A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going …

  Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  Mar 27, 2026
• Critical 9.9
  CVE-2024-9264 Public exploit Scanner template EPSS 98%

  Grafana SQL Expressions allow for remote code execution

  The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Oct 18, 2024
• Medium 5.1
  CVE-2024-8118 Public exploit

  Grafana alerting wrong permission on datasource rule write endpoint

  In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

  Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  Sep 26, 2024
• Medium 6.6
  CVE-2022-29170 Public exploit

  Grafana Enterprise datasource network restrictions bypass via HTTP redirects

  Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present…

  Grafana Grafana grafana Web / CMS Alpine
  May 20, 2022
• High 7.5
  CVE-2021-43798 Exploited Public exploit Scanner template EPSS 89%

  Grafana path traversal

  Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

  Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
  Dec 7, 2021

  KEV Oct 9, 2025
• Medium 5.8
  CVE-2020-13379 Public exploit Scanner template EPSS 100%

  Server Side Request Forgery in Grafana

  The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

  github.com/grafana/grafana grafana Alpine Go
  Jun 3, 2020
• Unscored —
  CVE-2019-15043 Public exploit Scanner template EPSS 63%

  In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run…

  grafana grafana Ubuntu Alpine
  Sep 3, 2019