Skip to content
OpenAdvisories

Vendor

Grafana

157 known vulnerabilities.

Products

Grafana OSS 58 Grafana 57 Grafana Enterprise 53 grafana/grafana 4 grafana/grafana-enterprise 4 Tempo 3 Grafana MCP Server 2 Enterprise Traces (GET) 2 Elasticsearch Datasource 2 Loki 2 Alloy 2 grafana-image-renderer 2 mcp-grafana 1 Grafana Operator 1 Grafana Snowflake Datasource Plugin 1 Snowflake Datasource 1 Enterprise Metrics (GEM) 1 Grafana Mimir 1 Grafana OSS and Enterprise 1 (built-in) Google Cloud Monitoring Datasource 1 Prometheus Datasource 1 mcp-k6 1 Clickhouse Datasource 1 Grafana Databricks Datasource Plugin 1 Pyroscope 1 Agent Flow 1 grafana-zabbix-plugin 1 Grafana IRM 1 Grafana Alerting 1 Grafana Correlations 1 grafana-csv-datasource 1 agent 1 Nanogit 1 PostgreSQL Datasource 1 google-sheets-datasource 1 MySQL Datasource 1 Microsoft SQL Server Datasource 1 worldmap-panel 1 grafana-infinity-datasource 1 OnCall 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.7
    CVE-2026-100105 Public exploit

    Alerting contact point authorization bypass via schema downgrade

    A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • High 8.6
    CVE-2026-15583 Public exploit

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrar…

    Grafana Grafana MCP Server Web / CMS
  • High 8.1
    CVE-2026-21721 Public exploit

    Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

    The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This i…

    Grafana grafana/grafana-enterprise grafana/grafana grafana Web / CMS Ubuntu
  • High 7.6
    CVE-2025-4123 Public exploit Scanner template EPSS 97%

    Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerab…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • High 7.5
    CVE-2021-43798 Exploited Public exploit Scanner template EPSS 89%

    Grafana path traversal

    Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

    Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
    KEV Oct 9, 2025