Grafana Enterprise vulnerabilities
19 known vulnerabilities in Grafana Enterprise from Grafana. 19 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Elasticsearch Datasource: Improper Limitation of a Pathname to a Restricted Directory
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappin
- 7.1 High severity
Grafana Enterprise: Exposure of Sensitive Information to an Unauthorized Actor
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned das
- 7.1 High severity
Grafana Enterprise: Improper Privilege Management
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API
- 7.1 High severity
Grafana OSS: Exposure of Sensitive Information to an Unauthorized Actor
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This af
- 8.5 High severity
Grafana OSS: Missing Authorization
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13
- 7.7 High severity
A user with query access to an Azure Monitor data source in Grafana can cause server-side…
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
- 8.9 High severity
Grafana Enterprise: Improper Authorization
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsA
- 7.7 High severity
Grafana Enterprise: Incorrect Authorization
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect aler
- 7.1 High severity
Grafana Enterprise: Improper Access Control
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rul
- 7.3 High severity
Grafana OSS: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
- 8.8 High severity
Grafana OSS: Improper Limitation of a Pathname to a Restricted Directory
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable b
- 8.1 High severity
Grafana Enterprise: Authentication Bypass by Spoofing
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct ide
- 7.1 High severity
Grafana OSS: Incorrect Authorization
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data acc
- 7.5 High severity
Grafana Enterprise: Uncontrolled Resource Consumption
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exha
- 9.8 Critical severity
Grafana Enterprise: Incorrect Privilege Assignment
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and
- 7.2 High severity
Grafana Enterprise: Permissive List of Allowed Inputs
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypas
- 7.2 High severity
Grafana Enterprise: Improper Privilege Management
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Org
- 9.8 Critical severity
Grafana: Authentication Bypass by Spoofing
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- 7.5 High severity
Grafana: Exposure of Sensitive Information to an Unauthorized Actor
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" conf