# github.com/grafana/grafana (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-grafana-grafana Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-grafana-grafana.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 69 vulnerabilities in github.com/grafana/grafana (Go): 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 2 exploited in the wild. The most recent, CVE-2026-42127, was published on 22 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 69 (3 critical, 2 exploited in the wild) ## About github.com/grafana/grafana (Go) Open-source platform for monitoring and observability with dashboarding and alerting capabilities. ## Latest github.com/grafana/grafana (Go) vulnerabilities - [CVE-2026-42127: Grafana denial of service in public dashboard query endpoint](https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint) (high, CVSS 7.5, published 22 Jun 2026) - [CVE-2026-9029: Grafana OSS stored XSS in geomap panel XYZ tile layer](https://junglewise.ai/threats/cve-2026-9029-grafana-oss-stored-xss-in-geomap-panel-xyz-tile-layer) (high, CVSS 7.3, published 22 Jun 2026) - [CVE-2026-42129: Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2026-10601: Grafana Tempo and Loki plugins path traversal](https://junglewise.ai/threats/cve-2026-10601-grafana-tempo-and-loki-plugins-path-traversal) (medium, CVSS 5.4, published 22 Jun 2026) - [CVE-2026-33381: Grafana improper access control in service account token minting](https://junglewise.ai/threats/cve-2026-33381-grafana-improper-access-control-in-service-account-token-minting) (medium, CVSS 5.9, published 13 May 2026) - [CVE-2026-33380: Grafana arbitrary file read in SQL Expressions](https://junglewise.ai/threats/cve-2026-33380-grafana-arbitrary-file-read-in-sql-expressions) (medium, CVSS 6.3, published 13 May 2026) - [CVE-2026-21727: Grafana legacy correlations allow cross-tenant disclosure and deletion](https://junglewise.ai/threats/cve-2026-21727-grafana-legacy-correlations-allow-cross-tenant-disclosure-and) (low, CVSS 3.3, published 15 Apr 2026) - [CVE-2026-27877: Grafana information disclosure of data-source passwords in public dashboards](https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-21724: Grafana OSS authorization bypass in provisioning contact points API](https://junglewise.ai/threats/cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points) (medium, CVSS 5.4, published 26 Mar 2026) - [CVE-2025-41117: Grafana XSS in Explore Traces view via Jaeger HTTP API](https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api) (medium, CVSS 6.8, published 12 Feb 2026) - [CVE-2025-41115: GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability) (critical, CVSS 10, published 21 Nov 2025) - [CVE-2025-3415: GO-2025-3814 - Grafana's insecure DingDing Alert integration exposes sensitive information in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-3415-grafana-s-insecure-dingding-alert-integration-exposes-sensitive) (low, CVSS 3.1, published 29 Jul 2025) - [CVE-2025-6023: GO-2025-3817 - Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-6023-grafana-is-vulnerable-to-xss-attacks-through-open-redirects-and) (low, CVSS 3.1, published 29 Jul 2025) - [CVE-2025-1088: GO-2025-3766 - Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-1088-grafana-long-dashboard-title-or-panel-name-causes-unresponsives) (low, CVSS 3.1, published 28 Jul 2025) - [CVE-2025-3454: GO-2025-3742 - Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-3454-grafana-s-datasource-proxy-api-allows-authorization-checks-to-be) (low, CVSS 3.1, published 9 Jun 2025) - [CVE-2025-3260: GO-2025-3740 - Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in…](https://junglewise.ai/threats/cve-2025-3260-grafana-vulnerable-to-authenticated-users-bypassing-dashboard) (low, CVSS 3.1, published 9 Jun 2025) - [CVE-2025-4123: GO-2025-3704 - Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-4123-grafana-cross-site-scripting-xss-via-custom-loaded-frontend-plugin) (low, CVSS 3.1, published 27 May 2025) - [CVE-2024-11741: Grafana Alerting VictorOps integration could be exposed to users with Viewer permission](https://junglewise.ai/threats/cve-2024-11741-grafana-alerting-victorops-integration-could-be-exposed-to-users) (low, CVSS 3.1, published 4 Feb 2025) - [CVE-2024-10452: GO-2024-3240 - Grafana org admin can delete pending invites in different org in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2024-10452-grafana-org-admin-can-delete-pending-invites-in-different-org) (low, CVSS 3.1, published 4 Nov 2024) - [CVE-2024-9264: GO-2024-3215 - Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2024-9264-grafana-command-injection-and-local-file-inclusion-via-sql) (low, CVSS 3.1, published 28 Oct 2024) - [CVE-2024-6322: GO-2024-3079 - Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2024-6322-grafana-plugin-data-sources-vulnerable-to-access-control-bypass) (low, CVSS 3.1, published 22 Aug 2024) - [CVE-2018-15727: GO-2022-0707 - Grafana Authentication Bypass in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2018-15727-grafana-authentication-bypass) (low, CVSS 3, published 21 Aug 2024) - [CVE-2018-18623: GO-2022-0342 - Grafana XSS in Dashboard Text Panel in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2018-18623-grafana-xss-in-dashboard-text-panel) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-12459: GO-2024-2519 - Grafana world readable configuration files in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2020-12459-grafana-world-readable-configuration-files) (low, CVSS 3.1, published 2 Jul 2024) - [CVE-2020-11110: GO-2024-2523 - Grafana stored XSS in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2020-11110-grafana-stored-xss) (low, CVSS 3.1, published 28 Jun 2024) ## Most severe github.com/grafana/grafana (Go) vulnerabilities - [CVE-2021-39226: Authentication bypass for viewing and deletions of snapshots](https://junglewise.ai/threats/cve-2021-39226-grafana-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Oct 2021) - [CVE-2021-43798: Grafana path traversal](https://junglewise.ai/threats/cve-2021-43798-grafana-path-traversal-in-plugin-assets) (critical, exploited in the wild, CVSS 3.1, published 1 Feb 2024) - [CVE-2025-41115: GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability) (critical, CVSS 10, published 21 Nov 2025) - [CVE-2026-42129: Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2026-42127: Grafana denial of service in public dashboard query endpoint](https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint) (high, CVSS 7.5, published 22 Jun 2026) - [CVE-2026-9029: Grafana OSS stored XSS in geomap panel XYZ tile layer](https://junglewise.ai/threats/cve-2026-9029-grafana-oss-stored-xss-in-geomap-panel-xyz-tile-layer) (high, CVSS 7.3, published 22 Jun 2026) - [CVE-2025-41117: Grafana XSS in Explore Traces view via Jaeger HTTP API](https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api) (medium, CVSS 6.8, published 12 Feb 2026) - [CVE-2026-27877: Grafana information disclosure of data-source passwords in public dashboards](https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-33380: Grafana arbitrary file read in SQL Expressions](https://junglewise.ai/threats/cve-2026-33380-grafana-arbitrary-file-read-in-sql-expressions) (medium, CVSS 6.3, published 13 May 2026) - [CVE-2026-33381: Grafana improper access control in service account token minting](https://junglewise.ai/threats/cve-2026-33381-grafana-improper-access-control-in-service-account-token-minting) (medium, CVSS 5.9, published 13 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/grafana/grafana (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-grafana-grafana, 13 November 2026.