Grafana OSS
Grafana- Product type
- Other
- Catalog vulnerabilities
- 33
Severity across 33 analyzed records
en
Verify to analyze this security profile
As of 10/06/2026, within CyStack's analyzed data, Grafana OSS has 16 security vulnerabilities published in the last 90 days. Of these, 5 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Grafana OSS and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API | Exploitation statusNot known exploited | FixYes | Published09/30/2026 | SeverityMedium |
CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API | Exploitation statusNot known exploited | FixYes | Published09/30/2026 | SeverityMedium |
CVE-2026-81842Library panel can be moved into a folder without library panel create permission | Exploitation statusNot known exploited | FixYes | Published09/29/2026 | SeverityMedium |
CVE-2026-81841Paused shared dashboard access tokens still expose data source configuration | Exploitation statusNot known exploited | FixYes | Published09/29/2026 | SeverityMedium |
CVE-2026-15815CVE-2026-15815 CVE Record | Exploitation statusNot known exploited | FixYes | Published09/17/2026 | SeverityHigh |
CVE-2026-76154CVE-2026-76154 CVE Record | Exploitation statusNot known exploited | FixYes | Published09/17/2026 | SeverityHigh |
CVE-2026-14199Session takeover via Auth Proxy cache key collision | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityHigh |
CVE-2026-19475SQL Data Source Plugin: OOM DoS via $__timeGroup macro | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityMedium |
CVE-2026-19197Broken access control in dashboard snapshots | Exploitation statusNot known exploited | FixYes | Published08/26/2026 | SeverityMedium |
CVE-2026-17033CVE-2026-17033 CVE Record | Exploitation statusNot known exploited | FixYes | Published08/24/2026 | SeverityMedium |
CVE-2026-17183CVE-2026-17183 CVE Record | Exploitation statusNot known exploited | FixYes | Published08/19/2026 | SeverityHigh |
CVE-2026-11817CVE-2026-11817 CVE Record | Exploitation statusNot known exploited | FixYes | Published08/17/2026 | SeverityMedium |
CVE-2026-21723CVE-2026-21723 Record | Exploitation statusNot known exploited | FixYes | Published07/23/2026 | SeverityMedium |
CVE-2026-8595Stored XSS in the table panel (TableNG) | Exploitation statusNot known exploited | FixYes | Published07/10/2026 | SeverityMedium |
CVE-2026-8609Pre-authentication denial of service via the OAuth login route | Exploitation statusNot known exploited | FixYes | Published07/10/2026 | SeverityMedium |
CVE-2026-33382Denial of service via unbounded request body size | Exploitation statusNot known exploited | FixYes | Published07/10/2026 | SeverityHigh |
CVE-2026-28378Cross-Organization Public Dashboard Deletion via Missing Org Isolation | Exploitation statusNot known exploited | FixYes | Published07/07/2026 | SeverityLow |
CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpoint | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-9029Stored XSS in the Geomap panel tile-layer attribution | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-10601Path traversal in the Tempo and Loki data source plugins | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityMedium |
CVE-2026-42129Path traversal in the Loki data source plugin | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-28374IDOR in Annotations API allows unprivileged users to DELETE annotation | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocation | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-33376Auth Proxy IPv6 whitelist bypass | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-33380SQL Expressions Read File From Disk | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-28380BAC in Snapshot API allows deletion of unauthorized dashboard snapshots | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-33381Users can generate Service Account tokens after permissions removal | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-33377Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-28376Grafana Live push endpoint allows unbounded memory allocation leading to OOM | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-28379Viewer-triggered race condition in Grafana Live leads to complete server crash | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-21724Missing Protected-field Authorization in Provisioning Contact Points API | Exploitation statusNot known exploited | FixYes | Published03/26/2026 | SeverityMedium |
CVE-2026-33375Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS | Exploitation statusNot known exploited | FixYes | Published03/26/2026 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan