These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-15815 debrief: Grafana OSS and Grafana Enterprise plugin archive extraction vulnerability leads to remote code execution. The vulnerability allows a crafted plugin archive to write arbitrary files and an executable backend binary outside the plugin installation directory, resulting in remote code execution with the privileges of the Grafana server process. Operators should assess exposure and pri [truncated]
CVE-2026-14199 is a high-severity vulnerability affecting self-managed Grafana instances with Auth Proxy authentication and identity caching enabled. An authenticated user can shape their attributes to collide with a higher-privileged user's cache entry, allowing authentication as that user, potentially up to Administrator privileges. This issue arises from the Auth Proxy cache key concatenating username [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-27T17:17:43.030Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This vulnerability involves the ClickHouse plugin using Native protocol with PDC or secure SOCKS configurations, leading to potential sensitive data exposure due to the connection library ignoring TL [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T09:16:45.727Z and has not been modified since then. This vulnerability affects Grafana instances where users with organization administrator permissions have elevated access. A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-24T14:16:50.717Z and has not been modified since then. CVE-2026-17033 is a vulnerability in Grafana that allows an authenticated attacker with Editor access or alert.instances.external:write permissions to submit an external Alertmanager alert with a controlled generatorURL. When a user with read ac [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T18:16:35.940Z and has not been modified since then. This CVE-2026-17183 vulnerability allows an authenticated user with permission to create or edit alert rules to bypass datasource query authorization. The user can do this by marking an alert rule query as a server-side expression while referenc [truncated]
CVE-2026-11817 is a limited cross-organization information disclosure vulnerability affecting Grafana stacks configured with multiple organizations. An Org Admin can access permission data of other organizations, including dashboard and folder identifiers and per-user permission mappings, via the GET /api/access-control/users/permissions/search endpoint. This vulnerability does not expose dashboard conten [truncated]
The CVE-2026-19516 vulnerability is a critical server-side request forgery (SSRF) issue in Grafana, which allows an attacker to control the destination of outbound requests using the X-Grafana-URL request header and grafana_api_request tool. This vulnerability has a CVSS score of 9.1 and is considered critical. Grafana users, administrators, and security teams should be aware of this vulnerability and tak [truncated]
CVE-2026-21729 is a high-severity vulnerability affecting Grafana Loki, a log aggregation system. The vulnerability allows Loki queries with large limits to cause large memory allocations, potentially impacting the availability of the service depending on its deployment strategy. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service). This issue was reported by [email protected]. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. System administrators should assess the vulnerability and apply [truncated]
CVE-2026-8595 is a stored cross-site scripting (XSS) vulnerability in Grafana. A user with Editor permissions can create a dashboard with a TableNG panel containing a malicious field name. When another user views this dashboard, the malicious field name executes as a script in their browser. The vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity.
CVE-2026-33382 is a HIGH severity vulnerability in Grafana API endpoints that can cause denial of service via excessive memory allocation. The CVE record was published on 2026-07-10T16:16:29.130Z and was last modified on 2026-07-10T18:01:31.563Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects Grafana API endpoints, some of which are unauthenticated, allowing an attacker to send l [truncated]
CVE-2026-28378 is a security issue in the public dashboard deletion endpoint of Grafana. An Org Admin in one organization can delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers. This issue arises from the endpoint's failure to enforce organization isolation. The vulnerability has a CVSS score of 3.1 and a severity of LOW. Users should verify thei [truncated]
CVE-2026-42127 is a high-severity vulnerability in Grafana's public dashboard query endpoint. The endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vul [truncated]
CVE-2026-28381 is a critical vulnerability with a CVSS score of 9.6, affecting the Snowflake data source in Grafana. The vulnerability allows any user with access to run queries against the data source to read and write files between the local Grafana server and the connected Snowflake host. This issue poses a significant risk as it could enable unauthorized data access or modification. Organizations usin [truncated]
A critical security vulnerability has been discovered in the Grafana Operator, affecting all versions up to and including 5.23. This vulnerability, tracked as CVE-2026-11769, allows a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
CVE-2026-33381 is a vulnerability in Grafana that allows users to mint tokens for a service account for a short period after their access has been revoked. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. Grafana has released an advisory for this vulnerability.
CVE-2026-33380 is a medium-severity vulnerability in Grafana's SQL Expressions feature. An authenticated attacker can exploit this vulnerability to read arbitrary files from the Grafana server's filesystem. This vulnerability is only exploitable if the sqlExpressions feature toggle is enabled.
CVE-2026-28376 is a medium-severity (CVSS 6.5) denial-of-service vulnerability in Grafana affecting multiple versions. The Grafana Live push endpoint fails to properly limit request body sizes, allowing authenticated attackers to trigger unbounded memory allocation through large or streaming requests, potentially causing out-of-memory conditions. The vulnerability requires low attack complexity and low pr [truncated]
CVE-2026-28375 is a medium-severity vulnerability in Grafana's testdata data-source that can trigger out-of-memory crashes. The vulnerability was published on March 27, 2026, and last modified on June 17, 2026. It has a CVSS score of 6.5 and is classified as CWE-400. The vulnerability affects multiple versions of Grafana, including those prior to 8.1.0, 11.6.14, 12.0.0, 12.1.10, 12.2.8, and 12.3.6. Users [truncated]
CVE-2026-27880 is a high-severity denial-of-service issue described by NVD as an unbounded-memory read in the OpenFeature feature toggle evaluation endpoint that can lead to out-of-memory crashes. The record is network-exploitable, requires no privileges or user interaction, and is rated 7.5 (HIGH).
CVE-2026-27879 is a medium-severity vulnerability affecting Grafana, a popular open-source analytics and visualization platform. The vulnerability allows an attacker to trigger an out-of-memory crash by sending a specially crafted resample query. This can be done by an attacker with low privileges, making it a concern for organizations using Grafana. The vulnerability has a CVSS score of 6.5 and is tracke [truncated]
CVE-2026-27877 is a Grafana information-disclosure issue affecting public dashboards that use direct data-sources. According to the CVE description, passwords for direct data-sources can be exposed even when those data-sources are not actually used in the dashboards. Grafana states that proxied data-sources are not exposed and recommends converting direct data-sources to proxied data-sources wherever possible.
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. This vulnerability has a CVSS score of 6.5 and is classified as Medium severity. The flaw affects multiple versions of Grafana, including 11.6.0 to 11.6.14, 12.1.0 to 12.1.10, 12.2.0 t [truncated]
CVE-2026-21725 describes a race-condition/TOCTOU issue in Grafana datasource deletion handling. Under a very narrow set of conditions, an attacker who previously had admin access to a datasource can delete it, wait for someone else to recreate it with the same UID, and then delete the recreated datasource without having admin rights on the new object. The practical risk is limited by several gating condit [truncated]
CVE-2026-21721 is a HIGH-severity vulnerability in Grafana's dashboard permissions API. The API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. This oversight allows a user who has permission management rights on one dashboard to read and modify permissions on other dashboards. This is considered an organization-internal privilege escalation. The vulnerabili [truncated]
CVE-2026-21720 is a HIGH severity vulnerability in Grafana that can lead to memory exhaustion and crashes due to uncached avatar requests. Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, causing the goroutine to block forever. Susta [truncated]