Skip to content
OpenAdvisories

Vendor

Grafana

157 known vulnerabilities.

Products

Grafana OSS 58 Grafana 57 Grafana Enterprise 53 grafana/grafana 4 grafana/grafana-enterprise 4 Tempo 3 Grafana MCP Server 2 Enterprise Traces (GET) 2 Elasticsearch Datasource 2 Loki 2 Alloy 2 grafana-image-renderer 2 mcp-grafana 1 Grafana Operator 1 Grafana Snowflake Datasource Plugin 1 Snowflake Datasource 1 Enterprise Metrics (GEM) 1 Grafana Mimir 1 Grafana OSS and Enterprise 1 (built-in) Google Cloud Monitoring Datasource 1 Prometheus Datasource 1 mcp-k6 1 Clickhouse Datasource 1 Grafana Databricks Datasource Plugin 1 Pyroscope 1 Agent Flow 1 grafana-zabbix-plugin 1 Grafana IRM 1 Grafana Alerting 1 Grafana Correlations 1 grafana-csv-datasource 1 agent 1 Nanogit 1 PostgreSQL Datasource 1 google-sheets-datasource 1 MySQL Datasource 1 Microsoft SQL Server Datasource 1 worldmap-panel 1 grafana-infinity-datasource 1 OnCall 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-19516 Public exploit

    CVE-2026-19516 CVE Record

    A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configur…

    Grafana Grafana MCP Server mcp-grafana Web / CMS
  • Critical 9.1
    CVE-2026-27876 Public exploit

    RCE on Grafana via sqlExpressions

    A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going …

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Critical 10.0
    CVE-2025-41115 Public exploit EPSS 17%

    Incorrect privilege assignment

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled an…

    Grafana Grafana Enterprise github.com/grafana/grafana Web / CMS Go
  • Critical 9.9
    CVE-2024-9264 Public exploit Scanner template EPSS 98%

    Grafana SQL Expressions allow for remote code execution

    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go