Skip to content
OpenAdvisories

Vendor

Grafana

157 known vulnerabilities.

Products

Grafana OSS 58 Grafana 57 Grafana Enterprise 53 grafana/grafana 4 grafana/grafana-enterprise 4 Tempo 3 Grafana MCP Server 2 Enterprise Traces (GET) 2 Elasticsearch Datasource 2 Loki 2 Alloy 2 grafana-image-renderer 2 mcp-grafana 1 Grafana Operator 1 Grafana Snowflake Datasource Plugin 1 Snowflake Datasource 1 Enterprise Metrics (GEM) 1 Grafana Mimir 1 Grafana OSS and Enterprise 1 (built-in) Google Cloud Monitoring Datasource 1 Prometheus Datasource 1 mcp-k6 1 Clickhouse Datasource 1 Grafana Databricks Datasource Plugin 1 Pyroscope 1 Agent Flow 1 grafana-zabbix-plugin 1 Grafana IRM 1 Grafana Alerting 1 Grafana Correlations 1 grafana-csv-datasource 1 agent 1 Nanogit 1 PostgreSQL Datasource 1 google-sheets-datasource 1 MySQL Datasource 1 Microsoft SQL Server Datasource 1 worldmap-panel 1 grafana-infinity-datasource 1 OnCall 1
All Critical High Medium Low Exploited only Public exploit

89 results · Clear filters · Feed

  • Medium 6.6
    CVE-2022-29170 Public exploit

    Grafana Enterprise datasource network restrictions bypass via HTTP redirects

    Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present…

    Grafana Grafana grafana Web / CMS Alpine
  • Medium 4.3
    CVE-2022-21713

    Exposure of Sensitive Information in Grafana

    Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.3
    CVE-2022-21703

    Cross Site Request Forgery in Grafana

    Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.5
    CVE-2022-21702

    Cross site scripting in Grafana proxy

    Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 4.3
    CVE-2022-21673

    OAuth Identity Token exposure in Grafana

    Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the …

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Medium 4.3
    CVE-2021-43815

    Grafana directory traversal for `.cvs` files

    Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source e…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 4.3
    CVE-2021-43813 EPSS 57%

    Directory Traversal in Grafana

    Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allo…

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Medium 6.5
    CVE-2021-41090

    Instance config inline secret exposure

    Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two end…

    Grafana agent github.com/grafana/agent Go
  • Medium 6.9
    CVE-2021-41174 Scanner template EPSS 85%

    XSS vulnerability allowing arbitrary JavaScript execution

    Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's…

    Grafana Grafana grafana @grafana/data Web / CMS Ubuntu npm