Grafana Grafana OSS
44 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-79656 | ≤ 12.3.11 ; 12.4.0 – < 12.4.11 ; 13.0.0 – < 13.0.9 ; … | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-103506 | 13.2.0 – 13.2.4 | SSO settings authorization bypass | HIGH 8.9 | 0.3 % | ||
| CVE-2026-88858 | 7.4.0 – 11.6.16 ; 12.0.0 – 12.2.10 ; 12.3.0 – 12.3.11 ; … | Server-side expression parser denial of service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-88967 | 10.0.0 – 11.6.16 ; 12.0.0 – 12.2.10 ; 12.3.0 – 12.3.11 ; … | Azure Monitor access token disclosure via SSRF | HIGH 7.7 | 0.3 % | ||
| CVE-2026-100105 | 12.4.0 – 12.4.13 ; 13.0.0 – 13.0.11 ; 13.1.0 – 13.1.8 ; … | Alerting contact point authorization bypass via schema downgrade | HIGH 7.7 | 0.3 % | ||
| CVE-2026-16491 | 13.0.0 – 13.1.1 | CVE-2026-16491 CVE Record | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-9703 | 12.3.0 – 12.3.8 ; 12.4.0 – 12.4.5 ; 8.0.0 – 12.3.0 ; … | Viewer role can create, modify and delete Loki alerting rules | HIGH 7.1 | 0.2 % | ||
| CVE-2026-95502 | 13.0.0 – < 13.0.11 ; 13.1.0 – < 13.1.8 ; 13.2.0 – < 13.2.4 | Git Sync memory exhaustion via a malicious Git server | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-93294 | 8.1.0 – 12.3.11 ; 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; … | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-33374 | 12.0.0 – 12.3.11 ; 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; … | Unbounded memory allocation in the Prometheus rule conversion API | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-15577 | 12.4.0 – < 12.4.13 ; 13.0.0 – < 13.0.11 ; 13.1.0 – < 13.1.8 ; … | Git Sync connection configuration can be modified with read-only access | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-13720 | 12.0.0 – 12.0.10 ; 12.1.0 – 12.1.10 ; 12.2.0 – 12.2.11 ; … | Editor can forge file-provisioning provenance on dashboards via the dashboard API | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-13719 | 12.3.0 – 12.3.11 ; 12.4.0 – < 12.4.12 ; 13.0.0 – < 13.0.10 ; … | Alert rules in restricted folders disclosed via the alert rules list API | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-81842 | 12.1.0 – 12.1.10 ; 12.2.0 – 12.2.11 ; 12.3.0 – 12.3.11 ; … | Library panel can be moved into a folder without library panel create permission | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-81841 | 11.6.0 – 11.6.17 ; 12.0.0 – 12.0.10 ; 12.1.0 – 12.1.10 ; … | Paused shared dashboard access tokens still expose data source configuration | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-15815 | 11.6.0 – 11.6.17 ; 12.0.0 ; 12.1.0 ; … | CVE-2026-15815 CVE Record | HIGH 8.8 | 0.7 % | ||
| CVE-2026-76154 | 12.3.0 ; 12.4.0 – 12.4.10 ; 13.0.0 – 13.0.8 ; … | CVE-2026-76154 CVE Record | HIGH 7.3 | 0.4 % | ||
| CVE-2026-14199 | 11.0.0 – 11.6.17 ; 12.0.0 – 12.2.11 ; 12.3.0 – 12.3.11 ; … | Session takeover via Auth Proxy cache key collision | HIGH 8.1 | 0.3 % | ||
| CVE-2026-19475 | 11.6.0 – 11.6.16 ; 12.0.0 – 12.0.10 ; 12.1.0 – 12.1.10 ; … | SQL Data Source Plugin: OOM DoS via $__timeGroup macro | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-19197 | 12.4.0 – < 12.4.8 ; 13.0.0 – < 13.0.6 ; 13.1.0 – < 13.1.3 | Broken access control in dashboard snapshots | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-17033 | ≤ 12.3.11 ; 12.4.0 – 12.4.9 ; 13.0.0 – 13.0.7 | CVE-2026-17033 CVE Record | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-17183 | 8.4.0 – < 12.3.11 ; 12.4.0 – < 12.4.9 ; 13.0.0 – < 13.0.7 ; … | CVE-2026-17183 CVE Record | HIGH 7.1 | 0.3 % | ||
| CVE-2026-11817 | 12.4.0 – 12.4.5 ; 11.2.0 – 11.6.16 ; 13.0.0 – 13.0.3 ; … | CVE-2026-11817 CVE Record | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-21723 | 8.0.0 – 11.0.0 ; 11.0.0 – 11.6.10 ; 12.0.0 – 12.0.9 ; … | CVE-2026-21723 Record | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-8595 | 12.4.0 – 12.4.3 ; 13.0.0 – 13.0.1 | Stored XSS in the table panel (TableNG) | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-8609 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Pre-authentication denial of service via the OAuth login route | HIGH 7.5 | 0.4 % | ||
| CVE-2026-33382 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Denial of service via unbounded request body size | HIGH 7.5 | 0.4 % | ||
| CVE-2026-28378 | 11.6.0 – 11.6.13 ; 12.1.0 – 12.1.9 ; 12.2.0 – 12.2.7 ; … | Cross-Organization Public Dashboard Deletion via Missing Org Isolation | LOW 3.1 | 0.2 % | ||
| CVE-2026-42127 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Pre-authentication denial of service in the public dashboard query endpoint | HIGH 7.5 | 0.4 % | ||
| CVE-2026-9029 | 12.4.0 – 12.4.3 ; 13.0.0 – 13.0.1 | Stored XSS in the Geomap panel tile-layer attribution | HIGH 7.3 | 0.3 % | ||
| CVE-2026-10601 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Path traversal in the Tempo and Loki data source plugins | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-42129 | 11.6.0 – 11.6.14 ; 12.2.0 – 12.2.8 ; 12.3.0 – 12.3.6 ; … | Path traversal in the Loki data source plugin | HIGH 7.7 | 0.4 % | ||
| CVE-2026-28374 | 8.5.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | IDOR in Annotations API allows unprivileged users to DELETE annotation | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-33378 | 8.0.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-28383 | 6.7.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Grafana plugin resources can lead to unbounded memory allocation | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-33376 | 9.4.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Auth Proxy IPv6 whitelist bypass | HIGH 7.4 | 0.3 % | ||
| CVE-2026-33380 | 11.6.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | SQL Expressions Read File From Disk | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-28380 | 9.4.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | BAC in Snapshot API allows deletion of unauthorized dashboard snapshots | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-33381 | 9.2.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Users can generate Service Account tokens after permissions removal | HIGH 8.1 | 0.3 % | ||
| CVE-2026-33377 | 8.5.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin | HIGH 7.1 | 0.2 % | ||
| CVE-2026-28376 | 8.0.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Grafana Live push endpoint allows unbounded memory allocation leading to OOM | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-28379 | 8.2.0 – 11.6.14 ; 11.6.14 – < 11.6.14+security-04 ; 12.0.0 – 12.2.8 ; … | Viewer-triggered race condition in Grafana Live leads to complete server crash | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-21724 | 12.3.1 – < 12.3.6 ; 12.2.2 – < 12.2.8 ; 12.1.5 – < 12.1.10 ; … | Missing Protected-field Authorization in Provisioning Contact Points API | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-33375 | 11.6.0 – < 11.6.14+security-01 ; 12.1.0 – < 12.1.10+security-01 ; 12.2.0 – < 12.2.8+security-01 ; … | Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS | MEDIUM 6.5 | 0.5 % |