Grafana Grafana Enterprise
39 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-79656 | ≤ 12.3.11 ; 12.4.0 – < 12.4.11 ; 13.0.0 – < 13.0.9 ; … | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-103506 | 13.2.0 – 13.2.4 | SSO settings authorization bypass | HIGH 8.9 | 0.3 % | ||
| CVE-2026-88858 | 7.4.0 – 11.6.16 ; 12.0.0 – 12.2.10 ; 12.3.0 – 12.3.11 ; … | Server-side expression parser denial of service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-88967 | 10.0.0 – 11.6.16 ; 12.0.0 – 12.2.10 ; 12.3.0 – 12.3.11 ; … | Azure Monitor access token disclosure via SSRF | HIGH 7.7 | 0.3 % | ||
| CVE-2026-100105 | 12.4.0 – 12.4.13 ; 13.0.0 – 13.0.11 ; 13.1.0 – 13.1.8 ; … | Alerting contact point authorization bypass via schema downgrade | HIGH 7.7 | 0.3 % | ||
| CVE-2026-16491 | 13.0.0 – 13.0.4 ; 13.1.0 – 13.1.1 | CVE-2026-16491 CVE Record | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-92539 | 11.6.0 – 12.3.11 ; 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; … | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | MEDIUM 6.7 | 0.3 % | ||
| CVE-2026-9703 | 8.0.0 – 11.5.10 ; 11.6.0 – 11.6.16 ; 12.0.0 – 12.1.10 ; … | Viewer role can create, modify and delete Loki alerting rules | HIGH 7.1 | 0.2 % | ||
| CVE-2026-95502 | 13.0.0 – < 13.0.11 ; 13.1.0 – < 13.1.8 ; 13.2.0 – < 13.2.4 | Git Sync memory exhaustion via a malicious Git server | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-93294 | 8.1.0 – 12.3.11 ; 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; … | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-33374 | 12.0.0 – 12.3.11 ; 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; … | Unbounded memory allocation in the Prometheus rule conversion API | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-15577 | 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; 13.1.0 – < 13.1.8 ; … | Git Sync connection configuration can be modified with read-only access | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-13720 | 12.0.0 – 12.0.10 ; 12.1.0 – 12.1.10 ; 12.2.0 – 12.2.11 ; … | Editor can forge file-provisioning provenance on dashboards via the dashboard API | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-13719 | 12.3.0 – 12.3.11 ; 12.4.0 – < 12.4.12 ; 13.0.0 – < 13.0.10 ; … | Alert rules in restricted folders disclosed via the alert rules list API | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-81842 | 12.1.0 – 12.1.10 ; 12.2.0 – 12.2.11 ; 12.3.0 – 12.3.11 ; … | Library panel can be moved into a folder without library panel create permission | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-81841 | 11.6.0 – 11.6.17 ; 12.0.0 – 12.0.10 ; 12.1.0 – 12.1.10 ; … | Paused shared dashboard access tokens still expose data source configuration | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-15815 | 11.6.0 – 11.6.17 ; 12.0.0 ; 12.1.0 ; … | CVE-2026-15815 CVE Record | HIGH 8.8 | 0.7 % | ||
| CVE-2026-76154 | 12.3.0 ; 12.4.0 – 12.4.10 ; 13.0.0 – 13.0.8 ; … | CVE-2026-76154 CVE Record | HIGH 7.3 | 0.4 % | ||
| CVE-2026-14199 | 11.0.0 – 11.6.17 ; 12.0.0 – 12.2.11 ; 12.3.0 – 12.3.11 ; … | Session takeover via Auth Proxy cache key collision | HIGH 8.1 | 0.3 % | ||
| CVE-2026-12704 | 11.6.0 – 11.6.17 ; 12.2.0 – 12.2.11 ; 12.3.0 – 12.3.11 ; … | SAML assertion replay via skipped InResponseTo validation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-19197 | 12.4.0 – < 12.4.8 ; 13.0.0 – < 13.0.6 ; 13.1.0 – < 13.1.3 | Broken access control in dashboard snapshots | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-17183 | 8.4.0 – < 12.3.11 ; 12.4.0 – < 12.4.9 ; 13.0.0 – < 13.0.7 ; … | CVE-2026-17183 CVE Record | HIGH 7.1 | 0.3 % | ||
| CVE-2026-11817 | 13.0.0 – 13.0.3 ; 12.2.0 – 12.2.10 ; 11.2.0 – 11.6.16 ; … | CVE-2026-11817 CVE Record | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-28378 | 11.6.0 – 11.6.13 ; 12.1.0 – 12.1.9 ; 12.2.0 – 12.2.7 ; … | Cross-Organization Public Dashboard Deletion via Missing Org Isolation | LOW 3.1 | 0.2 % | ||
| CVE-2026-42127 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Pre-authentication denial of service in the public dashboard query endpoint | HIGH 7.5 | 0.4 % | ||
| CVE-2025-41115 | 12.0.0 – < 12.2.1 | Incorrect privilege assignment | CRITICAL 10.0 | 17 % | ||
| CVE-2025-3454 | 11.6.0 – < 11.6.0+security-01 ; 11.5.0 – < 11.5.3+security-01 ; 11.4.0 – < 11.4.3+security-01 ; … | This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the UR | MEDIUM 5.0 | 0.5 % | ||
| CVE-2025-2703 | 11.6.0 – < 11.6.0+security-01 ; 11.5.0 – < 11.5.3+security-01 ; 11.4.0 – < 11.4.3+security-01 ; … | The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in or | MEDIUM 6.8 | 16 % | ||
| CVE-2024-6322 | 11.1.0 – < 11.1.1 ; 11.1.2 – < 11.1.3 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account | MEDIUM 5.4 | 0.3 % | ||
| CVE-2023-6152 | 2.5.0 – < 9.5.16 ; 10.0.0 – < 10.0.11 ; 10.1.0 – < 10.1.7 ; … | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration opt | MEDIUM 5.4 | 1.4 % | ||
| CVE-2023-4399 | 10.1.0 – < 10.1.5 ; 10.0.0 – < 10.0.9 ; 9.5.0 – < 9.5.13 ; … | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows ad | HIGH 7.2 | 1.3 % | ||
| CVE-2023-4822 | 8.0.0 – < 9.4.16 ; 9.5.0 – < 9.5.11 ; 10.0.0 – < 10.0.7 ; … | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, | HIGH 7.2 | 1.3 % | ||
| CVE-2023-3128 | 9.5.0 – < 9.5.4 ; 9.4.0 – < 9.4.13 ; 9.3.0 – < 9.3.16 ; … | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily mod | CRITICAL 9.8 | 4.0 % | ||
| CVE-2023-2183 | 8.0.0 – < 8.5.26 ; 9.0.0 – < 9.2.19 ; 9.3.0 – < 9.3.15 ; … | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel | MEDIUM 6.4 | 1.0 % | ||
| CVE-2023-2801 | 9.4.0 – < 9.4.12 ; 9.5.0 – < 9.5.3 | Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data source | HIGH 7.5 | 0.7 % | ||
| CVE-2023-1387 | 9.1.0 – < 9.2.17 ; 9.3.0 – < 9.3.13 ; 9.4.0 – < 9.5.0 | Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to searc | HIGH 7.5 | 1.5 % | ||
| CVE-2023-1410 | 8.0.0 – < 8.5.22 ; 9.0.0 – < 9.2.15 ; 9.3.0 – < 9.3.11 | Stored XSS in Graphite FunctionDescription tooltip | MEDIUM 6.2 | 1.0 % | ||
| CVE-2023-0594 | 7.0.0 – < 8.5.21 ; 9.0.0 – < 9.2.13 ; 9.3.0 – < 9.3.8 | Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability | HIGH 7.3 | 9.2 % | ||
| CVE-2023-0507 | 8.1.0 – < 8.5.21 ; 9.0.0 – < 9.2.13 ; 9.3.0 – < 9.3.8 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability | HIGH 7.3 | 15 % |