Grafana Enterprise
Monthly
Grafana OSS and Grafana Enterprise 13.2 installations that have explicitly enabled the experimental kubernetesSsoSettingsApi feature toggle let any authenticated user read SSO client secrets and modify instance-wide SSO configuration, because the SSO settings endpoints are missing an authorization check (CWE-285). Default deployments are not exposed, since the toggle ships disabled, and an attacker needs a valid Grafana account but not the SSO-settings permission that should normally be enforced. No public exploit code or confirmed active exploitation has been identified at time of analysis; the Grafana security advisory is the authoritative reference for fixed releases and any interim guidance.
Grafana OSS and Grafana Enterprise can be tricked into sending server-side requests to an attacker-controlled endpoint that carry the Azure Monitor data source's Azure access token, handing that credential to the attacker. The flaw is only reachable in deployments that have an Azure Monitor data source configured, and only by an authenticated account holding query access to that data source (PR:L) - anonymous users cannot reach it, and instances without an Azure Monitor data source are not exposed. Because the stolen token grants access outside Grafana itself, the vector carries a scope change with high confidentiality impact and no integrity or availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, placing it in a this-week remediation cadence rather than an emergency.
Grafana OSS and Grafana Enterprise 12.4.x through 13.2.x allow an authenticated user who can edit contact points but is denied permission to edit their protected fields to change those protected settings - including a contact point's destination URL - by switching an integration to a legacy schema version, potentially exposing stored credentials and redirecting alert notifications. The underlying issue is an incorrect authorization check (CWE-863) rated 7.7 with a scope change; no public exploit code and no CISA KEV entry are identified at time of analysis, and the vuln.today decision label is 'this_week', making this a credible operational priority rather than an emergency.
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
Symlink-based archive extraction in Grafana OSS and Grafana Enterprise lets a malicious plugin archive write arbitrary files - including an executable backend binary - outside the plugin installation directory, and that binary then runs with the Grafana server process's privileges, yielding remote code execution. Exploitation is gated on a Grafana operator installing a plugin from an attacker-influenced archive (via the plugin catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall configuration), which is the UI:R component of the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector; there is no unattended remote trigger against a running server. A key aggravating factor is that plugin archives are extracted before their signature is verified, so enforcing signed plugins does not mitigate this issue, and Grafana Enterprise carries the identical extraction code. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk paper cut.
Stored cross-site scripting in Grafana's Geomap panel allows an authenticated user holding at least the Editor role to embed a malicious MapLibre base-layer style configuration whose attacker-controlled JavaScript executes in the browser session of any other user who views the panel, including an Org Admin, enabling privilege escalation to Org Admin. Exploitation is privilege-gated and interaction-dependent: the attacker needs an Editor account and the ability to host or point the panel at an external style config, and a different user must render the panel. Both Grafana OSS and Grafana Enterprise are affected across the 12.3.0, 12.4.x (through 12.4.10), 13.0.x (through 13.0.8), 13.1.x (through 13.1.5) and 13.2.x (through 13.2.1) release lines, per ENISA EUVD-2026-82430; no public exploit code was identified at time of analysis.
Remote code execution is achievable in Grafana installations through a chained attack combining SQL Expressions with a Grafana Enterprise plugin, affecting both open-source and Enterprise deployments. The vulnerability requires high-privilege authenticated access (PR:H) but enables cross-scope impact with complete system compromise once exploited. Only instances with the sqlExpressions feature toggle enabled are vulnerable, though Grafana recommends all users update to prevent future exploitation paths using this attack vector. No public exploit identified at time of analysis, and authentication as a high-privilege user is required per CVSS vector.
Grafana's Generic OAuth, Google, and GitLab sign-in integrations can write users' OAuth/OIDC access, refresh, and ID tokens to server logs unredacted, letting anyone with read access to those logs or to the log store they are shipped to recover the tokens. The leak is conditional: it occurs when an access or ID token is not a valid JWT, when the ID token is missing at debug log level, or when the ID token is not a string, and the value of any recovered token is bounded by the scopes granted to the configured OAuth client. Grafana OSS and Grafana Enterprise are affected (CVSS 6.0, AV:L/PR:H), and exploitation requires standing privileged access to the logs; no public exploit is identified at time of analysis.
Denial of service in Grafana OSS and Grafana Enterprise lets an authenticated user holding only the Viewer role crash the server by submitting a crafted server-side math expression that recurses without a depth limit (CWE-674). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must be logged in but needs no special UI interaction, and the impact is availability only - no confidentiality or integrity effect. A transient crash is reachable with Viewer privileges alone, while making the outage survive restarts additionally requires the elevated permission to provision alert rules; EUVD lists affected branches spanning the 7.4.0 line through 13.2.x for both OSS and Enterprise editions. No public exploit code or CISA KEV entry was identified at time of analysis, and the priority signal is this_month rather than act_now.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
The SCIM provisioning API in Grafana Enterprise resolves user objects by ID without scoping them to the caller's organization, so a service account holding user-management permissions in one org can read, modify, disable, or delete users that belong to every other org on the same instance (CWE-639 IDOR). Only Enterprise deployments with the non-default SCIM feature turned on are exposed, and the attacker must already control a privileged service account token (CVSS PR:H), which keeps this a moderate-priority 6.7 authorization flaw rather than a pre-auth compromise path. Practical impact concentrates on multi-organization, multi-tenant instances where cross-org victims actually exist; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Authenticated users can crash Grafana OSS and Grafana Enterprise by sending requests with unbounded body sizes to the Prometheus rule conversion API endpoints, causing unbounded memory allocation that leads to out-of-memory conditions and server unavailability. The vulnerability is rated CVSS 6.5 (moderate) and requires a valid Grafana account (PR:L) with access to these endpoints; no special feature toggle is needed. No public exploit has been identified at time of analysis, and the impact is limited to availability-there is no path to data access or code execution.
Incorrect authorization in Grafana 12.4 (OSS and Enterprise) allows an authenticated user or service account that holds only read-only access to Git Sync (provisioning) connections to rewrite those connections' configuration by sending requests to the connection's status subresource, which does not enforce the same authorization as the parent resource (CWE-863). Exploitation requires three things simultaneously: a valid low-privilege Grafana account, the affected 12.4 release, and the non-default experimental 'provisioning' feature toggle explicitly enabled - the vulnerable status subresource API does not exist otherwise, so anonymous or unprovisioned instances are not exposed. The impact is integrity-only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no data disclosure or service disruption, and no public exploit identified at time of analysis.
Azure Resource Manager API access can be abused by an authenticated Grafana user who has query access to an Azure Monitor data source, allowing that user to call ARM APIs beyond Grafana's intended scope using the data source's Azure identity. The issue is a confused-deputy flaw (CWE-441) in Grafana OSS and Grafana Enterprise with CVSS 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N); exploitation requires low-privileged Grafana authentication but is complicated by the need for an over-privileged Azure identity, and the advisory bounds impact to the Azure role assigned to that identity. No active exploitation is confirmed by CISA KEV and no public exploit is identified in the provided data.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.
Grafana OSS and Grafana Enterprise 13.2 installations that have explicitly enabled the experimental kubernetesSsoSettingsApi feature toggle let any authenticated user read SSO client secrets and modify instance-wide SSO configuration, because the SSO settings endpoints are missing an authorization check (CWE-285). Default deployments are not exposed, since the toggle ships disabled, and an attacker needs a valid Grafana account but not the SSO-settings permission that should normally be enforced. No public exploit code or confirmed active exploitation has been identified at time of analysis; the Grafana security advisory is the authoritative reference for fixed releases and any interim guidance.
Grafana OSS and Grafana Enterprise can be tricked into sending server-side requests to an attacker-controlled endpoint that carry the Azure Monitor data source's Azure access token, handing that credential to the attacker. The flaw is only reachable in deployments that have an Azure Monitor data source configured, and only by an authenticated account holding query access to that data source (PR:L) - anonymous users cannot reach it, and instances without an Azure Monitor data source are not exposed. Because the stolen token grants access outside Grafana itself, the vector carries a scope change with high confidentiality impact and no integrity or availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, placing it in a this-week remediation cadence rather than an emergency.
Grafana OSS and Grafana Enterprise 12.4.x through 13.2.x allow an authenticated user who can edit contact points but is denied permission to edit their protected fields to change those protected settings - including a contact point's destination URL - by switching an integration to a legacy schema version, potentially exposing stored credentials and redirecting alert notifications. The underlying issue is an incorrect authorization check (CWE-863) rated 7.7 with a scope change; no public exploit code and no CISA KEV entry are identified at time of analysis, and the vuln.today decision label is 'this_week', making this a credible operational priority rather than an emergency.
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
Symlink-based archive extraction in Grafana OSS and Grafana Enterprise lets a malicious plugin archive write arbitrary files - including an executable backend binary - outside the plugin installation directory, and that binary then runs with the Grafana server process's privileges, yielding remote code execution. Exploitation is gated on a Grafana operator installing a plugin from an attacker-influenced archive (via the plugin catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall configuration), which is the UI:R component of the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector; there is no unattended remote trigger against a running server. A key aggravating factor is that plugin archives are extracted before their signature is verified, so enforcing signed plugins does not mitigate this issue, and Grafana Enterprise carries the identical extraction code. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk paper cut.
Stored cross-site scripting in Grafana's Geomap panel allows an authenticated user holding at least the Editor role to embed a malicious MapLibre base-layer style configuration whose attacker-controlled JavaScript executes in the browser session of any other user who views the panel, including an Org Admin, enabling privilege escalation to Org Admin. Exploitation is privilege-gated and interaction-dependent: the attacker needs an Editor account and the ability to host or point the panel at an external style config, and a different user must render the panel. Both Grafana OSS and Grafana Enterprise are affected across the 12.3.0, 12.4.x (through 12.4.10), 13.0.x (through 13.0.8), 13.1.x (through 13.1.5) and 13.2.x (through 13.2.1) release lines, per ENISA EUVD-2026-82430; no public exploit code was identified at time of analysis.
Remote code execution is achievable in Grafana installations through a chained attack combining SQL Expressions with a Grafana Enterprise plugin, affecting both open-source and Enterprise deployments. The vulnerability requires high-privilege authenticated access (PR:H) but enables cross-scope impact with complete system compromise once exploited. Only instances with the sqlExpressions feature toggle enabled are vulnerable, though Grafana recommends all users update to prevent future exploitation paths using this attack vector. No public exploit identified at time of analysis, and authentication as a high-privilege user is required per CVSS vector.
Grafana's Generic OAuth, Google, and GitLab sign-in integrations can write users' OAuth/OIDC access, refresh, and ID tokens to server logs unredacted, letting anyone with read access to those logs or to the log store they are shipped to recover the tokens. The leak is conditional: it occurs when an access or ID token is not a valid JWT, when the ID token is missing at debug log level, or when the ID token is not a string, and the value of any recovered token is bounded by the scopes granted to the configured OAuth client. Grafana OSS and Grafana Enterprise are affected (CVSS 6.0, AV:L/PR:H), and exploitation requires standing privileged access to the logs; no public exploit is identified at time of analysis.
Denial of service in Grafana OSS and Grafana Enterprise lets an authenticated user holding only the Viewer role crash the server by submitting a crafted server-side math expression that recurses without a depth limit (CWE-674). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must be logged in but needs no special UI interaction, and the impact is availability only - no confidentiality or integrity effect. A transient crash is reachable with Viewer privileges alone, while making the outage survive restarts additionally requires the elevated permission to provision alert rules; EUVD lists affected branches spanning the 7.4.0 line through 13.2.x for both OSS and Enterprise editions. No public exploit code or CISA KEV entry was identified at time of analysis, and the priority signal is this_month rather than act_now.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
The SCIM provisioning API in Grafana Enterprise resolves user objects by ID without scoping them to the caller's organization, so a service account holding user-management permissions in one org can read, modify, disable, or delete users that belong to every other org on the same instance (CWE-639 IDOR). Only Enterprise deployments with the non-default SCIM feature turned on are exposed, and the attacker must already control a privileged service account token (CVSS PR:H), which keeps this a moderate-priority 6.7 authorization flaw rather than a pre-auth compromise path. Practical impact concentrates on multi-organization, multi-tenant instances where cross-org victims actually exist; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Authenticated users can crash Grafana OSS and Grafana Enterprise by sending requests with unbounded body sizes to the Prometheus rule conversion API endpoints, causing unbounded memory allocation that leads to out-of-memory conditions and server unavailability. The vulnerability is rated CVSS 6.5 (moderate) and requires a valid Grafana account (PR:L) with access to these endpoints; no special feature toggle is needed. No public exploit has been identified at time of analysis, and the impact is limited to availability-there is no path to data access or code execution.
Incorrect authorization in Grafana 12.4 (OSS and Enterprise) allows an authenticated user or service account that holds only read-only access to Git Sync (provisioning) connections to rewrite those connections' configuration by sending requests to the connection's status subresource, which does not enforce the same authorization as the parent resource (CWE-863). Exploitation requires three things simultaneously: a valid low-privilege Grafana account, the affected 12.4 release, and the non-default experimental 'provisioning' feature toggle explicitly enabled - the vulnerable status subresource API does not exist otherwise, so anonymous or unprovisioned instances are not exposed. The impact is integrity-only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no data disclosure or service disruption, and no public exploit identified at time of analysis.
Azure Resource Manager API access can be abused by an authenticated Grafana user who has query access to an Azure Monitor data source, allowing that user to call ARM APIs beyond Grafana's intended scope using the data source's Azure identity. The issue is a confused-deputy flaw (CWE-441) in Grafana OSS and Grafana Enterprise with CVSS 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N); exploitation requires low-privileged Grafana authentication but is complicated by the need for an over-privileged Azure identity, and the advisory bounds impact to the Azure role assigned to that identity. No active exploitation is confirmed by CISA KEV and no public exploit is identified in the provided data.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.