Grafana Cloud CVEs
86 vulnerabilities mapped to Grafana Cloud’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-92539 Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
CVSS 6.7 mediumEPSS 0.34%
CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules
CVSS 7.1 highEPSS 0.19%
CVE-2026-33374 Unbounded memory allocation in the Prometheus rule conversion API
CVSS 6.5 mediumEPSS 0.37%
CVE-2026-15577 Git Sync connection configuration can be modified with read-only access
CVSS 6.5 mediumEPSS 0.27%
CVE-2026-95502 Git Sync memory exhaustion via a malicious Git server
CVSS 5.3 mediumEPSS 0.37%
CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
CVSS 6.5 mediumEPSS 0.38%
CVE-2026-13720 Editor can forge file-provisioning provenance on dashboards via the dashboard API
CVSS 5.4 mediumEPSS 0.16%
CVE-2026-13719 Alert rules in restricted folders disclosed via the alert rules list API
CVSS 4.3 mediumEPSS 0.24%
CVE-2026-81842 Library panel can be moved into a folder without library panel create permission
CVSS 4.3 mediumEPSS 0.20%
CVE-2026-81841 Paused shared dashboard access tokens still expose data source configuration
CVSS 5.3 mediumEPSS 0.38%
CVE-2026-15815 CVE-2026-15815 CVE Record
CVSS 8.8 highEPSS 0.69%
CVE-2026-76154 CVE-2026-76154 CVE Record
CVSS 7.3 highEPSS 0.35%
CVE-2026-14199 Session takeover via Auth Proxy cache key collision
CVSS 7.1 highEPSS 0.33%
CVE-2026-12704 SAML assertion replay via skipped InResponseTo validation
CVSS 6.8 mediumEPSS 0.29%
CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro
CVSS 6.5 mediumEPSS 0.42%
CVE-2026-75889 CVE-2026-75889 CVE Record
CVSS 7.7 highEPSS 0.22%
CVE-2026-19854 CVE-2026-19854 CVE Record
CVSS 6.1 mediumEPSS 0.07%
CVE-2026-19197 Broken access control in dashboard snapshots
CVSS 6.3 mediumEPSS 0.15%
CVE-2026-17033 CVE-2026-17033 CVE Record
CVSS 6.8 mediumEPSS 0.22%
CVE-2026-17183 CVE-2026-17183 CVE Record
CVSS 7.1 highEPSS 0.29%
CVE-2026-11817 CVE-2026-11817 CVE Record
CVSS 5.3 mediumEPSS 0.35%
CVE-2026-19516 CVE-2026-19516 CVE Record
CVSS 9.1 criticalEPSS 0.31%
CVE-2026-9765 CVE-2026-9765 CVE Record
CVSS 7.1 highEPSS 0.40%
CVE-2026-21723 CVE-2026-21723 Record
CVSS 5.3 mediumEPSS 0.22%
CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation
CVSS 7.5 highEPSS 0.46%
CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
CVSS 8.6 highEPSS 0.53%
CVE-2026-8595 Stored XSS in the table panel (TableNG)
CVSS 6.8 mediumEPSS 0.24%
CVE-2026-8609 Pre-authentication denial of service via the OAuth login route
CVSS 5.3 mediumEPSS 0.40%
CVE-2026-33382 Denial of service via unbounded request body size
CVSS 7.5 highEPSS 0.39%
CVE-2026-28378 Cross-Organization Public Dashboard Deletion via Missing Org Isolation
CVSS 3.1 lowEPSS 0.23%
CVE-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint
CVSS 7.5 highEPSS 0.43%
CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVSS 9.6 criticalEPSS 0.35%
CVE-2026-9029 Stored XSS in the Geomap panel tile-layer attribution
CVSS 7.3 highEPSS 0.25%
CVE-2026-10601 Path traversal in the Tempo and Loki data source plugins
CVSS 5.4 mediumEPSS 0.29%
CVE-2026-42129 Path traversal in the Loki data source plugin
CVSS 7.7 highEPSS 0.44%
CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage
CVSS 6.5 mediumEPSS 0.41%
CVE-2026-11769 Operator - Namespaced User Path Traversal
CVSS 8.8 highEPSS 0.36%
CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation
CVSS 4.3 mediumEPSS 0.20%
CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation
CVSS 6.5 mediumEPSS 0.33%
CVE-2026-33376 Auth Proxy IPv6 whitelist bypass
CVSS 7.4 highEPSS 0.28%
CVE-2026-33380 SQL Expressions Read File From Disk
CVSS 6.3 mediumEPSS 0.35%
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
CVSS 6.5 mediumEPSS 0.23%
CVE-2026-33381 Users can generate Service Account tokens after permissions removal
CVSS 5.9 mediumEPSS 0.33%
CVE-2026-33377 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
CVSS 7.1 highEPSS 0.23%
CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM
CVSS 6.5 mediumEPSS 0.33%
CVE-2026-28379 Viewer-triggered race condition in Grafana Live leads to complete server crash
CVSS 6.5 mediumEPSS 0.26%
CVE-2026-21728 Tempo query limit results in unbounded memory allocation
CVSS 7.5 highEPSS 0.64%
CVE-2026-21726 Loki Path Traversal - CVE-2021-36156 Bypass
CVSS 5.3 mediumEPSS 0.41%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)