Skip to content
OpenAdvisories

Package · Ubuntu

grafana

98 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-27876 Public exploit

    RCE on Grafana via sqlExpressions

    A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going …

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Critical 9.9
    CVE-2024-9264 Public exploit Scanner template EPSS 98%

    Grafana SQL Expressions allow for remote code execution

    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  • Critical 9.8
    CVE-2018-15727 Public exploit EPSS 63%

    Grafana Authentication Bypass

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    grafana github.com/grafana/grafana Ubuntu Go