These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-21729 is a high-severity vulnerability affecting Grafana Loki, a log aggregation system. The vulnerability allows Loki queries with large limits to cause large memory allocations, potentially impacting the availability of the service depending on its deployment strategy. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). This issue was reported by [email protected]. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. System administrators should assess the vulnerability and apply [truncated]
CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana. A user with Editor permissions can create a dashboard with a TableNG panel containing a malicious field name. When another user views this dashboard, the malicious field name executes as a script in their browser. The vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity.
CVE-2026-33382 is a HIGH severity vulnerability in Grafana API endpoints that can cause denial of service via excessive memory allocation. The CVE record was published on 2026-07-10T16:16:29.130Z and was last modified on 2026-07-10T18:01:31.563Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects Grafana API endpoints, some of which are unauthenticated, allowing an attacker to send l [truncated]
CVE-2026-28378 is a security issue in the public dashboard deletion endpoint of Grafana. An Org Admin in one organization can delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers. This issue arises from the endpoint's failure to enforce organization isolation. The vulnerability has a CVSS score of 3.1 and a severity of LOW. Users should verify thei [truncated]
CVE-2026-42127 is a high-severity vulnerability in Grafana's public dashboard query endpoint. The endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vul [truncated]
CVE-2026-28381 is a critical vulnerability with a CVSS score of 9.6, affecting the Snowflake data source in Grafana. The vulnerability allows any user with access to run queries against the data source to read and write files between the local Grafana server and the connected Snowflake host. This issue poses a significant risk as it could enable unauthorized data access or modification. Organizations usin [truncated]
A critical security vulnerability has been discovered in the Grafana Operator, affecting all versions up to and including 5.23. This vulnerability, tracked as CVE-2026-11769, allows a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
CVE-2026-33381 is a vulnerability in Grafana that allows users to mint tokens for a service account for a short period after their access has been revoked. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. Grafana has released an advisory for this vulnerability.
CVE-2026-33380 is a medium-severity vulnerability in Grafana's SQL Expressions feature. An authenticated attacker can exploit this vulnerability to read arbitrary files from the Grafana server's filesystem. This vulnerability is only exploitable if the sqlExpressions feature toggle is enabled.
CVE-2026-28376 is a medium-severity (CVSS 6.5) denial-of-service vulnerability in Grafana affecting multiple versions. The Grafana Live push endpoint fails to properly limit request body sizes, allowing authenticated attackers to trigger unbounded memory allocation through large or streaming requests, potentially causing out-of-memory conditions. The vulnerability requires low attack complexity and low pr [truncated]
CVE-2026-28375 is a medium-severity vulnerability in Grafana's testdata data-source that can trigger out-of-memory crashes. The vulnerability was published on March 27, 2026, and last modified on June 17, 2026. It has a CVSS score of 6.5 and is classified as CWE-400. The vulnerability affects multiple versions of Grafana, including those prior to 8.1.0, 11.6.14, 12.0.0, 12.1.10, 12.2.8, and 12.3.6. Users [truncated]
CVE-2026-27880 is a high-severity denial-of-service issue described by NVD as an unbounded-memory read in the OpenFeature feature toggle evaluation endpoint that can lead to out-of-memory crashes. The record is network-exploitable, requires no privileges or user interaction, and is rated 7.5 (HIGH).
CVE-2026-27879 is a medium-severity vulnerability affecting Grafana, a popular open-source analytics and visualization platform. The vulnerability allows an attacker to trigger an out-of-memory crash by sending a specially crafted resample query. This can be done by an attacker with low privileges, making it a concern for organizations using Grafana. The vulnerability has a CVSS score of 6.5 and is tracke [truncated]
CVE-2026-27877 is a Grafana information-disclosure issue affecting public dashboards that use direct data-sources. According to the CVE description, passwords for direct data-sources can be exposed even when those data-sources are not actually used in the dashboards. Grafana states that proxied data-sources are not exposed and recommends converting direct data-sources to proxied data-sources wherever possible.
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. This vulnerability has a CVSS score of 6.5 and is classified as Medium severity. The flaw affects multiple versions of Grafana, including 11.6.0 to 11.6.14, 12.1.0 to 12.1.10, 12.2.0 t [truncated]
CVE-2026-21725 describes a race-condition/TOCTOU issue in Grafana datasource deletion handling. Under a very narrow set of conditions, an attacker who previously had admin access to a datasource can delete it, wait for someone else to recreate it with the same UID, and then delete the recreated datasource without having admin rights on the new object. The practical risk is limited by several gating condit [truncated]
CVE-2026-21721 is a HIGH-severity vulnerability in Grafana's dashboard permissions API. The API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. This oversight allows a user who has permission management rights on one dashboard to read and modify permissions on other dashboards. This is considered an organization-internal privilege escalation. The vulnerabili [truncated]
CVE-2026-21720 is a HIGH severity vulnerability in Grafana that can lead to memory exhaustion and crashes due to uncached avatar requests. Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, causing the goroutine to block forever. Susta [truncated]