Grafana has 59 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 18 in the last 90 days against 7 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 6.7 (medium), with 4 rated critical. 3% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-863 (8) and CWE-22 (7). Most affected products: github.com/grafana/grafana (17), Grafana (16), Grafana Enterprise (9).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 3% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —(2)
- Last 90 days
- 18 prev 7
Products
- github.com/grafana/grafana 17
- Grafana 16
- Grafana Enterprise 9
- Grafana OSS 6
- github.com/grafana/tempo 2
- Enterprise Metrics (GEM) 1
Worst active — by depth score
CVE-2021-39226High· 7.3Authentication bypass for viewing and deletions of snapshots85CVE-2021-43798High· 7.5Grafana path traversal84CVE-2023-3128Critical· 9.4Grafana vulnerable to Authentication Bypass by Spoofing64CVE-2026-27876Critical· 9.1A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE)62CVE-2026-21721High· 8.1The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action57
Grafana vulnerabilities
CVEs affecting Grafana, newest first. Open any entry for full detail, references, and exploit status.
60 CVEsRSS
CVE-2026-27877Medium· 6.5Grafana public dashboards disclose all direct mode datasources
Grafana public dashboards disclose all direct mode datasources
CVE-2026-28377High· 7.5Grafana Tempo has Inadequate Encryption Strength
Grafana Tempo has Inadequate Encryption Strength
CVE-2026-27876Critical· 9.1PoCA chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE)
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future…
CVE-2026-21724Medium· 5.4Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
CVE-2026-21721High· 8.1PoCThe dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on ot…
CVE-2026-21720High· 7.5Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that gorou…
CVE-2025-3415Medium· 4.3PoCGrafana's insecure DingDing Alert integration exposes sensitive information
Grafana's insecure DingDing Alert integration exposes sensitive information
CVE-2025-3260High· 8.3A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers…
CVE-2024-10452Low· 2.2Grafana org admin can delete pending invites in different org
Grafana org admin can delete pending invites in different org
CVE-2024-9264Critical· 9.9PoCGrafana SQL Expressions allow for remote code execution
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local…
CVE-2021-41244Critical· 9.1Grafana Fine-grained access control vulnerability
Grafana Fine-grained access control vulnerability
CVE-2021-43815Medium· 4.3Grafana directory traversal for .cvs files
Grafana directory traversal for .cvs files
CVE-2023-6152Medium· 5.4Email Validation Bypass And Preventing Sign Up From Email's Owner
Email Validation Bypass And Preventing Sign Up From Email's Owner
CVE-2021-43798High· 7.5CISA KEVPoCGrafana path traversal
Grafana path traversal
CVE-2019-19499Medium· 6.5Grafana Arbitrary File Read
Grafana Arbitrary File Read
CVE-2023-3128Critical· 9.4PoCGrafana vulnerable to Authentication Bypass by Spoofing
Grafana vulnerable to Authentication Bypass by Spoofing
CVE-2023-2183Medium· 4.1Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
CVE-2023-2801High· 7.5Grafana Missing Synchronization vulnerability
Grafana Missing Synchronization vulnerability
CVE-2023-1410Medium· 6.2Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
CVE-2023-0507High· 7.3Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attribut…
CVE-2023-22462Medium· 6.4Grafana vulnerable to Stored Cross-site Scripting in Text plugin
Grafana vulnerable to Stored Cross-site Scripting in Text plugin
CVE-2022-23498High· 7.1Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is …
CVE-2022-23552High· 7.3Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vu…
CVE-2022-39324Medium· 6.7Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy.…
CVE-2022-36062High· 7.6Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin …
CVE-2020-13430Medium· 6.1Grafana XSS via the OpenTSDB datasource
Grafana XSS via the OpenTSDB datasource
CVE-2020-12458Medium· 5.5Grafana information disclosure
Grafana information disclosure
CVE-2021-41090Medium· 6.5Instance config inline secret exposure in Grafana
Instance config inline secret exposure in Grafana
CVE-2021-39226High· 7.3CISA KEVPoCAuthentication bypass for viewing and deletions of snapshots
Authentication bypass for viewing and deletions of snapshots
CVE-2021-36156Medium· 5.3Path traversal in Grafana Loki
Path traversal in Grafana Loki