rewindex

ChangesGrafana CloudTrust page

Grafana Cloud: Trust page changed

Trust / securityChanged (not classified) (rule)Changed grafana.com (opens in new tab)
Summary

Grafana Cloud added four security advisories: three High-severity issues involving alerting contact points, Azure Monitor token disclosure and SSO settings, plus a Medium-severity server-side expression parser denial of service. Customers using these capabilities have new security notices to review; four older advisories were removed from the displayed list, which does not establish that those issues were resolved.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

Struck in red is what Grafana Cloud removed; blue is what they added. Muted text is unchanged context.

Added#1
Before: …records Published CVE Severity (CVSS) Advisory Title ‹date› nothing here ‹date› CVE-2026-93294 Medium (6.3) Azure Monitor data source…
After: …records Published CVE Severity (CVSS) Advisory Title ‹date› CVE-2026-100105 High (7.7) Alerting contact point authorization bypass via schema downgrade ‹date› CVE-2026-88967 High (7.7) Azure Monitor access token disclosure via SSRF ‹date› CVE-2026-88858 Medium (6.5) Server-side expression parser denial of service ‹date› CVE-2026-103506 High (8.9) SSO settings authorization bypass ‹date› CVE-2026-93294 Medium (6.3) Azure Monitor data source…
Removed#2
Before: …allows calls to arbitrary Azure Resource Manager APIs ‹date› CVE-2026-92539 Medium (6.7) Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise ‹date› CVE-2026-15577 Medium (6.5) Git Sync connection configuration can be modified with read-only access ‹date› CVE-2026-95502 Medium (5.3) Git Sync memory exhaustion via a malicious Git server ‹date› CVE-2026-33374 Medium (6.5) Unbounded memory allocation in the Prometheus rule conversion API View all security advisories Security Hall of Fame…
After: …allows calls to arbitrary Azure Resource Manager APIs removed View all security advisories Security Hall of Fame…
Added#3
Before: …Recent researcher credits for responsibly disclosed vulnerabilities. ‹date› nothing here ‹date› CVE-2026-76154 Responsibly disclosed by Eric Sowah Badger…
After: …Recent researcher credits for responsibly disclosed vulnerabilities. ‹date› CVE-2026-88967 Responsibly disclosed by rathina ‹date› CVE-2026-103506 Responsibly disclosed by kazuki-hanai ‹date› CVE-2026-76154 Responsibly disclosed by Eric Sowah Badger…
Removed#4
Before: …Lab, SeoulTech ‹date› CVE-2026-13719 Responsibly disclosed by mon3m ‹date› CVE-2026-81842 Responsibly disclosed by Dohyun Choi, CIS Lab, SeoulTech ‹date› CVE-2026-11817 Responsibly disclosed by Harish Kolla View the full Hall of Fame Security Notices…
After: …Lab, SeoulTech ‹date› CVE-2026-13719 Responsibly disclosed by mon3m removed View the full Hall of Fame Security Notices…

Compared with the previous archived version (#6905 to #10357). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this page

TodayWednesday, November 4Wed, Nov 4

1 page change

Thursday, October 29

1 page change

Saturday, October 24

1 page change

Wednesday, October 21

1 page change

Cite this

Trust page changed on Grafana Cloud’s Trust page, changed 2026-10-29 08:44 UTC (change 3 of 4).

Title
Trust page changed
Vendor
Grafana Cloud
Date
URL
https://rewindex.com/change/p10357

All Grafana Cloud changesGrafana Cloud profileMarkdownJSON