Grafana OSS vulnerabilities
20 known vulnerabilities in Grafana OSS from Grafana. 20 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Elasticsearch Datasource: Improper Limitation of a Pathname to a Restricted Directory
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappin
- 7.1 High severity
Grafana Enterprise: Exposure of Sensitive Information to an Unauthorized Actor
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned das
- 7.1 High severity
Grafana Enterprise: Improper Privilege Management
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API
- 7.1 High severity
Grafana OSS: Exposure of Sensitive Information to an Unauthorized Actor
When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This af
- 8.5 High severity
Grafana OSS: Missing Authorization
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13
- 7.7 High severity
A user with query access to an Azure Monitor data source in Grafana can cause server-side…
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
- 8.9 High severity
Grafana Enterprise: Improper Authorization
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsA
- 7.7 High severity
Grafana Enterprise: Incorrect Authorization
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect aler
- 7.1 High severity
Grafana Enterprise: Improper Access Control
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rul
- 7.3 High severity
Grafana OSS: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
- 8.8 High severity
Grafana OSS: Improper Limitation of a Pathname to a Restricted Directory
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable b
- 8.1 High severity
Grafana Enterprise: Authentication Bypass by Spoofing
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct ide
- 7.1 High severity
Grafana OSS: Incorrect Authorization
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data acc
- 7.5 High severity
Grafana OSS: Uncontrolled Resource Consumption
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
- 7.5 High severity
Grafana OSS: Uncontrolled Resource Consumption
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of
- 7.5 High severity
Grafana Enterprise: Uncontrolled Resource Consumption
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exha
- 7.7 High severity
Grafana OSS: Improper Limitation of a Pathname to a Restricted Directory
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
- 8.1 High severity
Grafana OSS: Improper Access Control
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
- 7.1 High severity
Grafana OSS: Improper Authentication
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
- 7.4 High severity
Grafana OSS: Initialization of a Resource with an Insecure Default
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML,