Grafana Oss
Monthly
Grafana OSS and Grafana Enterprise 13.2 installations that have explicitly enabled the experimental kubernetesSsoSettingsApi feature toggle let any authenticated user read SSO client secrets and modify instance-wide SSO configuration, because the SSO settings endpoints are missing an authorization check (CWE-285). Default deployments are not exposed, since the toggle ships disabled, and an attacker needs a valid Grafana account but not the SSO-settings permission that should normally be enforced. No public exploit code or confirmed active exploitation has been identified at time of analysis; the Grafana security advisory is the authoritative reference for fixed releases and any interim guidance.
Grafana OSS and Grafana Enterprise can be tricked into sending server-side requests to an attacker-controlled endpoint that carry the Azure Monitor data source's Azure access token, handing that credential to the attacker. The flaw is only reachable in deployments that have an Azure Monitor data source configured, and only by an authenticated account holding query access to that data source (PR:L) - anonymous users cannot reach it, and instances without an Azure Monitor data source are not exposed. Because the stolen token grants access outside Grafana itself, the vector carries a scope change with high confidentiality impact and no integrity or availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, placing it in a this-week remediation cadence rather than an emergency.
Grafana OSS and Grafana Enterprise 12.4.x through 13.2.x allow an authenticated user who can edit contact points but is denied permission to edit their protected fields to change those protected settings - including a contact point's destination URL - by switching an integration to a legacy schema version, potentially exposing stored credentials and redirecting alert notifications. The underlying issue is an incorrect authorization check (CWE-863) rated 7.7 with a scope change; no public exploit code and no CISA KEV entry are identified at time of analysis, and the vuln.today decision label is 'this_week', making this a credible operational priority rather than an emergency.
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
Symlink-based archive extraction in Grafana OSS and Grafana Enterprise lets a malicious plugin archive write arbitrary files - including an executable backend binary - outside the plugin installation directory, and that binary then runs with the Grafana server process's privileges, yielding remote code execution. Exploitation is gated on a Grafana operator installing a plugin from an attacker-influenced archive (via the plugin catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall configuration), which is the UI:R component of the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector; there is no unattended remote trigger against a running server. A key aggravating factor is that plugin archives are extracted before their signature is verified, so enforcing signed plugins does not mitigate this issue, and Grafana Enterprise carries the identical extraction code. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk paper cut.
Stored cross-site scripting in Grafana's Geomap panel allows an authenticated user holding at least the Editor role to embed a malicious MapLibre base-layer style configuration whose attacker-controlled JavaScript executes in the browser session of any other user who views the panel, including an Org Admin, enabling privilege escalation to Org Admin. Exploitation is privilege-gated and interaction-dependent: the attacker needs an Editor account and the ability to host or point the panel at an external style config, and a different user must render the panel. Both Grafana OSS and Grafana Enterprise are affected across the 12.3.0, 12.4.x (through 12.4.10), 13.0.x (through 13.0.8), 13.1.x (through 13.1.5) and 13.2.x (through 13.2.1) release lines, per ENISA EUVD-2026-82430; no public exploit code was identified at time of analysis.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions because the feature applies a /32 default mask to IPv6 addresses instead of the appropriate /128, dramatically widening the trusted address space and potentially admitting unauthorized clients into authenticated sessions. The flaw is confined to the Auth Proxy authentication path - Okta, SAML, and LDAP integrations are unaffected - and at this time there is no public exploit identified at time of analysis, with EPSS at 0.03% and SSVC marking exploitation as 'none.'
Privilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just revoked to continue minting tokens for several seconds after the revocation event. The flaw, tagged as an authentication bypass affecting multiple supported branches of Grafana OSS (11.x, 12.x, 13.x), can yield high confidentiality and integrity impact by granting persistent API access via newly minted service-account tokens. No public exploit identified at time of analysis, EPSS is very low (0.03%), and SSVC marks exploitation as none - but the vendor has issued patches across all affected branches.
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to overwrite that dashboard and acquire admin permissions on it. The flaw, tracked as CVE-2026-33377 and disclosed by Grafana with patches across multiple maintained branches, has CVSS 7.1 reflecting high integrity impact via low-privileged network access. There is no public exploit identified at time of analysis, and EPSS sits at 0.03% (8th percentile), but the high integrity impact warrants prompt patching for multi-tenant Grafana deployments.
Grafana's Generic OAuth, Google, and GitLab sign-in integrations can write users' OAuth/OIDC access, refresh, and ID tokens to server logs unredacted, letting anyone with read access to those logs or to the log store they are shipped to recover the tokens. The leak is conditional: it occurs when an access or ID token is not a valid JWT, when the ID token is missing at debug log level, or when the ID token is not a string, and the value of any recovered token is bounded by the scopes granted to the configured OAuth client. Grafana OSS and Grafana Enterprise are affected (CVSS 6.0, AV:L/PR:H), and exploitation requires standing privileged access to the logs; no public exploit is identified at time of analysis.
Denial of service in Grafana OSS and Grafana Enterprise lets an authenticated user holding only the Viewer role crash the server by submitting a crafted server-side math expression that recurses without a depth limit (CWE-674). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must be logged in but needs no special UI interaction, and the impact is availability only - no confidentiality or integrity effect. A transient crash is reachable with Viewer privileges alone, while making the outage survive restarts additionally requires the elevated permission to provision alert rules; EUVD lists affected branches spanning the 7.4.0 line through 13.2.x for both OSS and Enterprise editions. No public exploit code or CISA KEV entry was identified at time of analysis, and the priority signal is this_month rather than act_now.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
Authenticated users can crash Grafana OSS and Grafana Enterprise by sending requests with unbounded body sizes to the Prometheus rule conversion API endpoints, causing unbounded memory allocation that leads to out-of-memory conditions and server unavailability. The vulnerability is rated CVSS 6.5 (moderate) and requires a valid Grafana account (PR:L) with access to these endpoints; no special feature toggle is needed. No public exploit has been identified at time of analysis, and the impact is limited to availability-there is no path to data access or code execution.
Incorrect authorization in Grafana 12.4 (OSS and Enterprise) allows an authenticated user or service account that holds only read-only access to Git Sync (provisioning) connections to rewrite those connections' configuration by sending requests to the connection's status subresource, which does not enforce the same authorization as the parent resource (CWE-863). Exploitation requires three things simultaneously: a valid low-privilege Grafana account, the affected 12.4 release, and the non-default experimental 'provisioning' feature toggle explicitly enabled - the vulnerable status subresource API does not exist otherwise, so anonymous or unprovisioned instances are not exposed. The impact is integrity-only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no data disclosure or service disruption, and no public exploit identified at time of analysis.
Azure Resource Manager API access can be abused by an authenticated Grafana user who has query access to an Azure Monitor data source, allowing that user to call ARM APIs beyond Grafana's intended scope using the data source's Azure identity. The issue is a confused-deputy flaw (CWE-441) in Grafana OSS and Grafana Enterprise with CVSS 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N); exploitation requires low-privileged Grafana authentication but is complicated by the need for an over-privileged Azure identity, and the advisory bounds impact to the Azure role assigned to that identity. No active exploitation is confirmed by CISA KEV and no public exploit is identified in the provided data.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Stored cross-site scripting in Grafana OSS allows an authenticated Editor-level attacker to hijack the browser session of any user who clicks a crafted alert link, executing attacker-controlled JavaScript in the Grafana origin with the victim's permissions. The attack exploits unsanitized rendering of the external Alertmanager alert generatorURL field as an href in the Alert Details 'See source' LinkButton, combined with a bypass of Grafana's click-interceptor heuristic by embedding :// inside a JavaScript comment within a javascript: URI. No public exploit code or CISA KEV listing has been identified at time of analysis, but the bypass technique is fully disclosed in the CVE description, lowering the bar for weaponization.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, regardless of whether they hold read or create permissions on that annotation. The flaw affects a broad version range from 8.5.0 through 13.0.1, exposing organizations to unauthorized data destruction by low-privileged internal users. No active exploitation has been identified at time of analysis (SSVC: none; EPSS: 0.03%, 8th percentile), and no public exploit code exists; real-world risk is constrained by the authentication prerequisite and partial integrity-only impact.
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (OOM) crash by exploiting the $__timeGroup macro against a configured SQL datasource. The attack is slow by nature - requiring upwards of 30 minutes to exhaust server memory - and affects Grafana OSS versions spanning from 8.0.0 through 13.0.1. Grafana reported this vulnerability directly, a vendor patch is available across all affected release branches, and no public exploit code or active exploitation has been identified at time of analysis.
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to trigger an out-of-memory condition by sending a sufficiently large HTTP request body, resulting in denial of service against the Grafana instance. Affected versions span a wide range from 6.7.0 through 13.0.1, with vendor-released security patches available across all supported branches. No public exploit exists and CISA has not added this to the KEV catalog; the EPSS score of 0.04% (12th percentile) reflects very low observed exploitation probability.
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlExpressions feature toggle is enabled. Affected versions span the 11.6.x, 12.x, and 13.0.x release trains, with fixed security builds available across all affected branches. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the confidentiality impact is rated High by CVSS due to the potential for unrestricted file disclosure from the Grafana server's filesystem.
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete arbitrary snapshots across the platform, regardless of whether they hold read or write access to those snapshots. Affected versions span a wide release range from 9.4.0 through 13.0.1 across multiple major branches (CPE: cpe:2.3:a:grafana:grafana_oss). With EPSS at 0.03% (8th percentile), SSVC exploitation rated none, and no public exploit identified at time of analysis, the practical threat is primarily insider abuse or compromised Editor credentials being used to destroy monitoring data outside an attacker's legitimate scope.
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory by submitting a large or streaming HTTP request body, resulting in an out-of-memory condition and denial of service. Confirmed affected branches span Grafana OSS 8.0.0 through 13.0.1 across five actively maintained release lines, with vendor-released security patches available for each. No public exploit code exists and CISA has not listed this in KEV; the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low current real-world exploitation activity.
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sending concurrent requests triggers a fatal map access error that crashes the entire Grafana server, requiring a manual restart to restore service. All Grafana OSS releases from 8.2.0 through 13.0.1 are affected across multiple maintained branches, making the exposure surface exceptionally broad. No public exploit identified at time of analysis and EPSS sits at 0.04% (12th percentile), but the low privilege bar - any Viewer account - and reliable triggering (AC:L) mean insider threats and compromised low-privilege accounts represent a realistic DoS risk for organizations without guest/anonymous access controls.
Grafana OSS and Grafana Enterprise 13.2 installations that have explicitly enabled the experimental kubernetesSsoSettingsApi feature toggle let any authenticated user read SSO client secrets and modify instance-wide SSO configuration, because the SSO settings endpoints are missing an authorization check (CWE-285). Default deployments are not exposed, since the toggle ships disabled, and an attacker needs a valid Grafana account but not the SSO-settings permission that should normally be enforced. No public exploit code or confirmed active exploitation has been identified at time of analysis; the Grafana security advisory is the authoritative reference for fixed releases and any interim guidance.
Grafana OSS and Grafana Enterprise can be tricked into sending server-side requests to an attacker-controlled endpoint that carry the Azure Monitor data source's Azure access token, handing that credential to the attacker. The flaw is only reachable in deployments that have an Azure Monitor data source configured, and only by an authenticated account holding query access to that data source (PR:L) - anonymous users cannot reach it, and instances without an Azure Monitor data source are not exposed. Because the stolen token grants access outside Grafana itself, the vector carries a scope change with high confidentiality impact and no integrity or availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, placing it in a this-week remediation cadence rather than an emergency.
Grafana OSS and Grafana Enterprise 12.4.x through 13.2.x allow an authenticated user who can edit contact points but is denied permission to edit their protected fields to change those protected settings - including a contact point's destination URL - by switching an integration to a legacy schema version, potentially exposing stored credentials and redirecting alert notifications. The underlying issue is an incorrect authorization check (CWE-863) rated 7.7 with a scope change; no public exploit code and no CISA KEV entry are identified at time of analysis, and the vuln.today decision label is 'this_week', making this a credible operational priority rather than an emergency.
Authenticated Grafana users holding only the Viewer role can create, modify, and delete Loki alerting rules because Grafana's data source proxy fails to apply role-based access control to write requests forwarded to the Loki rules API at /loki/api/v1/rules. Both Grafana OSS and Grafana Enterprise are affected whenever a Loki data source is configured, and because the rules live in Loki rather than in Grafana, a Viewer's changes silently take effect for every user of that data source. Exploitation requires a valid Viewer account plus a configured Loki data source; no public exploit code has been identified at time of analysis, and Loki itself is not vulnerable and needs no patching.
Symlink-based archive extraction in Grafana OSS and Grafana Enterprise lets a malicious plugin archive write arbitrary files - including an executable backend binary - outside the plugin installation directory, and that binary then runs with the Grafana server process's privileges, yielding remote code execution. Exploitation is gated on a Grafana operator installing a plugin from an attacker-influenced archive (via the plugin catalog, grafana-cli, GF_INSTALL_PLUGINS, or preinstall configuration), which is the UI:R component of the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector; there is no unattended remote trigger against a running server. A key aggravating factor is that plugin archives are extracted before their signature is verified, so enforcing signed plugins does not mitigate this issue, and Grafana Enterprise carries the identical extraction code. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk paper cut.
Stored cross-site scripting in Grafana's Geomap panel allows an authenticated user holding at least the Editor role to embed a malicious MapLibre base-layer style configuration whose attacker-controlled JavaScript executes in the browser session of any other user who views the panel, including an Org Admin, enabling privilege escalation to Org Admin. Exploitation is privilege-gated and interaction-dependent: the attacker needs an Editor account and the ability to host or point the panel at an external style config, and a different user must render the panel. Both Grafana OSS and Grafana Enterprise are affected across the 12.3.0, 12.4.x (through 12.4.10), 13.0.x (through 13.0.8), 13.1.x (through 13.1.5) and 13.2.x (through 13.2.1) release lines, per ENISA EUVD-2026-82430; no public exploit code was identified at time of analysis.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions because the feature applies a /32 default mask to IPv6 addresses instead of the appropriate /128, dramatically widening the trusted address space and potentially admitting unauthorized clients into authenticated sessions. The flaw is confined to the Auth Proxy authentication path - Okta, SAML, and LDAP integrations are unaffected - and at this time there is no public exploit identified at time of analysis, with EPSS at 0.03% and SSVC marking exploitation as 'none.'
Privilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just revoked to continue minting tokens for several seconds after the revocation event. The flaw, tagged as an authentication bypass affecting multiple supported branches of Grafana OSS (11.x, 12.x, 13.x), can yield high confidentiality and integrity impact by granting persistent API access via newly minted service-account tokens. No public exploit identified at time of analysis, EPSS is very low (0.03%), and SSVC marks exploitation as none - but the vendor has issued patches across all affected branches.
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to overwrite that dashboard and acquire admin permissions on it. The flaw, tracked as CVE-2026-33377 and disclosed by Grafana with patches across multiple maintained branches, has CVSS 7.1 reflecting high integrity impact via low-privileged network access. There is no public exploit identified at time of analysis, and EPSS sits at 0.03% (8th percentile), but the high integrity impact warrants prompt patching for multi-tenant Grafana deployments.
Grafana's Generic OAuth, Google, and GitLab sign-in integrations can write users' OAuth/OIDC access, refresh, and ID tokens to server logs unredacted, letting anyone with read access to those logs or to the log store they are shipped to recover the tokens. The leak is conditional: it occurs when an access or ID token is not a valid JWT, when the ID token is missing at debug log level, or when the ID token is not a string, and the value of any recovered token is bounded by the scopes granted to the configured OAuth client. Grafana OSS and Grafana Enterprise are affected (CVSS 6.0, AV:L/PR:H), and exploitation requires standing privileged access to the logs; no public exploit is identified at time of analysis.
Denial of service in Grafana OSS and Grafana Enterprise lets an authenticated user holding only the Viewer role crash the server by submitting a crafted server-side math expression that recurses without a depth limit (CWE-674). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must be logged in but needs no special UI interaction, and the impact is availability only - no confidentiality or integrity effect. A transient crash is reachable with Viewer privileges alone, while making the outage survive restarts additionally requires the elevated permission to provision alert rules; EUVD lists affected branches spanning the 7.4.0 line through 13.2.x for both OSS and Enterprise editions. No public exploit code or CISA KEV entry was identified at time of analysis, and the priority signal is this_month rather than act_now.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
Authenticated users can crash Grafana OSS and Grafana Enterprise by sending requests with unbounded body sizes to the Prometheus rule conversion API endpoints, causing unbounded memory allocation that leads to out-of-memory conditions and server unavailability. The vulnerability is rated CVSS 6.5 (moderate) and requires a valid Grafana account (PR:L) with access to these endpoints; no special feature toggle is needed. No public exploit has been identified at time of analysis, and the impact is limited to availability-there is no path to data access or code execution.
Incorrect authorization in Grafana 12.4 (OSS and Enterprise) allows an authenticated user or service account that holds only read-only access to Git Sync (provisioning) connections to rewrite those connections' configuration by sending requests to the connection's status subresource, which does not enforce the same authorization as the parent resource (CWE-863). Exploitation requires three things simultaneously: a valid low-privilege Grafana account, the affected 12.4 release, and the non-default experimental 'provisioning' feature toggle explicitly enabled - the vulnerable status subresource API does not exist otherwise, so anonymous or unprovisioned instances are not exposed. The impact is integrity-only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no data disclosure or service disruption, and no public exploit identified at time of analysis.
Azure Resource Manager API access can be abused by an authenticated Grafana user who has query access to an Azure Monitor data source, allowing that user to call ARM APIs beyond Grafana's intended scope using the data source's Azure identity. The issue is a confused-deputy flaw (CWE-441) in Grafana OSS and Grafana Enterprise with CVSS 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N); exploitation requires low-privileged Grafana authentication but is complicated by the need for an over-privileged Azure identity, and the advisory bounds impact to the Azure role assigned to that identity. No active exploitation is confirmed by CISA KEV and no public exploit is identified in the provided data.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Stored cross-site scripting in Grafana OSS allows an authenticated Editor-level attacker to hijack the browser session of any user who clicks a crafted alert link, executing attacker-controlled JavaScript in the Grafana origin with the victim's permissions. The attack exploits unsanitized rendering of the external Alertmanager alert generatorURL field as an href in the Alert Details 'See source' LinkButton, combined with a bypass of Grafana's click-interceptor heuristic by embedding :// inside a JavaScript comment within a javascript: URI. No public exploit code or CISA KEV listing has been identified at time of analysis, but the bypass technique is fully disclosed in the CVE description, lowering the bar for weaponization.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, regardless of whether they hold read or create permissions on that annotation. The flaw affects a broad version range from 8.5.0 through 13.0.1, exposing organizations to unauthorized data destruction by low-privileged internal users. No active exploitation has been identified at time of analysis (SSVC: none; EPSS: 0.03%, 8th percentile), and no public exploit code exists; real-world risk is constrained by the authentication prerequisite and partial integrity-only impact.
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (OOM) crash by exploiting the $__timeGroup macro against a configured SQL datasource. The attack is slow by nature - requiring upwards of 30 minutes to exhaust server memory - and affects Grafana OSS versions spanning from 8.0.0 through 13.0.1. Grafana reported this vulnerability directly, a vendor patch is available across all affected release branches, and no public exploit code or active exploitation has been identified at time of analysis.
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to trigger an out-of-memory condition by sending a sufficiently large HTTP request body, resulting in denial of service against the Grafana instance. Affected versions span a wide range from 6.7.0 through 13.0.1, with vendor-released security patches available across all supported branches. No public exploit exists and CISA has not added this to the KEV catalog; the EPSS score of 0.04% (12th percentile) reflects very low observed exploitation probability.
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlExpressions feature toggle is enabled. Affected versions span the 11.6.x, 12.x, and 13.0.x release trains, with fixed security builds available across all affected branches. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the confidentiality impact is rated High by CVSS due to the potential for unrestricted file disclosure from the Grafana server's filesystem.
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete arbitrary snapshots across the platform, regardless of whether they hold read or write access to those snapshots. Affected versions span a wide release range from 9.4.0 through 13.0.1 across multiple major branches (CPE: cpe:2.3:a:grafana:grafana_oss). With EPSS at 0.03% (8th percentile), SSVC exploitation rated none, and no public exploit identified at time of analysis, the practical threat is primarily insider abuse or compromised Editor credentials being used to destroy monitoring data outside an attacker's legitimate scope.
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory by submitting a large or streaming HTTP request body, resulting in an out-of-memory condition and denial of service. Confirmed affected branches span Grafana OSS 8.0.0 through 13.0.1 across five actively maintained release lines, with vendor-released security patches available for each. No public exploit code exists and CISA has not listed this in KEV; the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low current real-world exploitation activity.
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sending concurrent requests triggers a fatal map access error that crashes the entire Grafana server, requiring a manual restart to restore service. All Grafana OSS releases from 8.2.0 through 13.0.1 are affected across multiple maintained branches, making the exposure surface exceptionally broad. No public exploit identified at time of analysis and EPSS sits at 0.04% (12th percentile), but the low privilege bar - any Viewer account - and reliable triggering (AC:L) mean insider threats and compromised low-privilege accounts represent a realistic DoS risk for organizations without guest/anonymous access controls.