{"schema_version":1,"title":"Grafana vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in Grafana: 8 in the last 7 days and 17 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81843, was published on 12 November 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4).","url":"https://junglewise.ai/threats/technologies/grafana-grafana","json_url":"https://junglewise.ai/threats/technologies/grafana-grafana.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/grafana-grafana","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":20,"critical":1,"exploited":0,"last_7_days":8,"last_30_days":11,"last_90_days":17,"last_365_days":20},"latest":[{"cve":"CVE-2026-81843","cvss":6.5,"slug":"cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and","title":"Grafana Elasticsearch data source denial of service via time range","severity":"medium","exploited":false,"published_at":"2026-11-12T18:17:53.47+00:00","url":"https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and"},{"cve":"CVE-2026-106475","cvss":7.1,"slug":"cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the","title":"Grafana Elasticsearch data source improper authorization in resource proxy","severity":"high","exploited":false,"published_at":"2026-11-12T18:17:12.72+00:00","url":"https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the"},{"cve":"CVE-2026-106472","cvss":6.3,"slug":"cve-2026-106472-grafana-s-prometheus-data-source-passes-the-resource-path","title":"Grafana Prometheus data source path traversal","severity":"medium","exploited":false,"published_at":"2026-11-12T18:17:12.56+00:00","url":"https://junglewise.ai/threats/cve-2026-106472-grafana-s-prometheus-data-source-passes-the-resource-path"},{"cve":"CVE-2026-82014","cvss":4.3,"slug":"cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the","title":"Grafana authorization bypass in team preferences endpoint","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:25.02+00:00","url":"https://junglewise.ai/threats/cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the"},{"cve":"CVE-2026-13721","cvss":6.5,"slug":"cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete","title":"Grafana authorization bypass in Git Sync provisioning API","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:22.7+00:00","url":"https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete"},{"cve":"CVE-2026-111000","cvss":7.1,"slug":"cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it","title":"Grafana privilege escalation in folder move API","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:14.503+00:00","url":"https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it"},{"cve":"CVE-2026-110992","cvss":6.5,"slug":"cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role","title":"Grafana path traversal in Git Sync provisioning","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:14.37+00:00","url":"https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role"},{"cve":"CVE-2026-107509","cvss":6.5,"slug":"cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an","title":"Grafana SQL Expression denial of service via unbounded memory allocation","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:13.943+00:00","url":"https://junglewise.ai/threats/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an"},{"cve":"CVE-2026-79656","cvss":6,"slug":"cve-2026-79656-a-user-with-read-access-to-grafana-s-server-logs-or-to-a-log","title":"Grafana sensitive information disclosure in OAuth/OIDC token logging","severity":"medium","exploited":false,"published_at":"2026-10-28T18:17:20.27+00:00","url":"https://junglewise.ai/threats/cve-2026-79656-a-user-with-read-access-to-grafana-s-server-logs-or-to-a-log"},{"cve":"CVE-2026-88858","cvss":6.5,"slug":"cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by","title":"Grafana denial of service via crafted math expression","severity":"medium","exploited":false,"published_at":"2026-10-28T17:18:45.967+00:00","url":"https://junglewise.ai/threats/cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by"},{"cve":"CVE-2026-100105","cvss":7.7,"slug":"cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their","title":"Grafana authorization bypass via contact point legacy schema downgrade","severity":"high","exploited":false,"published_at":"2026-10-28T17:17:21.797+00:00","url":"https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their"},{"cve":"CVE-2026-95502","cvss":5.3,"epss":0.0037,"slug":"cve-2026-95502-a-git-server-that-grafana-s-git-sync-provisioning-is-configured","title":"Grafana Git Sync memory exhaustion via malicious Git server","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:26.79+00:00","url":"https://junglewise.ai/threats/cve-2026-95502-a-git-server-that-grafana-s-git-sync-provisioning-is-configured"},{"cve":"CVE-2026-93294","cvss":6.3,"epss":0.0027,"slug":"cve-2026-93294-a-user-with-query-access-to-an-azure-monitor-data-source-can-use","title":"Grafana Azure Monitor resource proxy unrestricted API access","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:26.663+00:00","url":"https://junglewise.ai/threats/cve-2026-93294-a-user-with-query-access-to-an-azure-monitor-data-source-can-use"},{"cve":"CVE-2026-13720","cvss":5.4,"slug":"cve-2026-13720-an-editor-can-set-file-provisioning-metadata-the-grafana-app","title":"Grafana authorization bypass in dashboard file-provisioning metadata","severity":"medium","exploited":false,"published_at":"2026-09-30T11:16:43.893+00:00","url":"https://junglewise.ai/threats/cve-2026-13720-an-editor-can-set-file-provisioning-metadata-the-grafana-app"},{"cve":"CVE-2026-13719","cvss":4.3,"slug":"cve-2026-13719-an-authenticated-user-can-list-alert-rules-stored-in-folders-they","title":"Grafana alert rules authorization bypass in API list endpoint","severity":"medium","exploited":false,"published_at":"2026-09-30T11:16:43.757+00:00","url":"https://junglewise.ai/threats/cve-2026-13719-an-authenticated-user-can-list-alert-rules-stored-in-folders-they"},{"cve":"CVE-2026-81842","cvss":4.3,"slug":"cve-2026-81842-an-authenticated-user-with-edit-permission-on-one-folder-can-move","title":"Grafana improper authorization in library panel folder move","severity":"medium","exploited":false,"published_at":"2026-09-29T21:19:31.583+00:00","url":"https://junglewise.ai/threats/cve-2026-81842-an-authenticated-user-with-edit-permission-on-one-folder-can-move"},{"cve":"CVE-2026-81841","cvss":5.3,"slug":"cve-2026-81841-pausing-a-shared-public-dashboard-did-not-revoke-its-access-token","title":"Grafana shared dashboard access token not revoked on pause","severity":"medium","exploited":false,"published_at":"2026-09-29T21:19:31.447+00:00","url":"https://junglewise.ai/threats/cve-2026-81841-pausing-a-shared-public-dashboard-did-not-revoke-its-access-token"},{"cve":"CVE-2026-21727","cvss":3.3,"epss":0.002,"slug":"cve-2026-21727-grafana-legacy-correlations-allow-cross-tenant-disclosure-and","title":"Grafana legacy correlations allow cross-tenant disclosure and deletion","severity":"low","exploited":false,"published_at":"2026-04-15T20:16:34.29+00:00","url":"https://junglewise.ai/threats/cve-2026-21727-grafana-legacy-correlations-allow-cross-tenant-disclosure-and"},{"cve":"CVE-2025-12141","cvss":6.5,"epss":0.0026,"slug":"cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a","title":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions…","severity":"medium","exploited":false,"published_at":"2026-04-15T16:16:33.04+00:00","url":"https://junglewise.ai/threats/cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a"},{"cve":"CVE-2025-41115","cvss":10,"epss":0.1691,"slug":"cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability","title":"GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana","severity":"critical","exploited":false,"published_at":"2025-11-21T15:15:52.283+00:00","url":"https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":8}],"related":[{"name":"Grafana Enterprise","slug":"grafana-grafana-enterprise","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/grafana-grafana-enterprise"},{"name":"Grafana OSS","slug":"grafana-grafana-oss","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/grafana-grafana-oss"}],"technology":{"hub":true,"name":"Grafana","slug":"grafana-grafana","vendor":{"hub":true,"name":"Grafana","slug":"grafana","url":"https://junglewise.ai/threats/vendors/grafana"},"aliases":[],"category":"web-server","homepage":"https://grafana.com","description":"Open-source platform for metrics visualization, monitoring, and alerting across multiple data sources.","url":"https://junglewise.ai/threats/technologies/grafana-grafana"},"most_severe":[{"cve":"CVE-2025-41115","cvss":10,"epss":0.1691,"slug":"cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability","title":"GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana","severity":"critical","exploited":false,"published_at":"2025-11-21T15:15:52.283+00:00","url":"https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability"},{"cve":"CVE-2026-100105","cvss":7.7,"slug":"cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their","title":"Grafana authorization bypass via contact point legacy schema downgrade","severity":"high","exploited":false,"published_at":"2026-10-28T17:17:21.797+00:00","url":"https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their"},{"cve":"CVE-2026-106475","cvss":7.1,"slug":"cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the","title":"Grafana Elasticsearch data source improper authorization in resource proxy","severity":"high","exploited":false,"published_at":"2026-11-12T18:17:12.72+00:00","url":"https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the"},{"cve":"CVE-2026-111000","cvss":7.1,"slug":"cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it","title":"Grafana privilege escalation in folder move API","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:14.503+00:00","url":"https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it"},{"cve":"CVE-2025-12141","cvss":6.5,"epss":0.0026,"slug":"cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a","title":"In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions…","severity":"medium","exploited":false,"published_at":"2026-04-15T16:16:33.04+00:00","url":"https://junglewise.ai/threats/cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a"},{"cve":"CVE-2026-81843","cvss":6.5,"slug":"cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and","title":"Grafana Elasticsearch data source denial of service via time range","severity":"medium","exploited":false,"published_at":"2026-11-12T18:17:53.47+00:00","url":"https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and"},{"cve":"CVE-2026-13721","cvss":6.5,"slug":"cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete","title":"Grafana authorization bypass in Git Sync provisioning API","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:22.7+00:00","url":"https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete"},{"cve":"CVE-2026-110992","cvss":6.5,"slug":"cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role","title":"Grafana path traversal in Git Sync provisioning","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:14.37+00:00","url":"https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role"},{"cve":"CVE-2026-107509","cvss":6.5,"slug":"cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an","title":"Grafana SQL Expression denial of service via unbounded memory allocation","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:13.943+00:00","url":"https://junglewise.ai/threats/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an"},{"cve":"CVE-2026-88858","cvss":6.5,"slug":"cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by","title":"Grafana denial of service via crafted math expression","severity":"medium","exploited":false,"published_at":"2026-10-28T17:18:45.967+00:00","url":"https://junglewise.ai/threats/cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by"}],"generated_at":"2026-11-12T19:07:00.167094+00:00"}