# Grafana vulnerabilities Source: https://junglewise.ai/threats/technologies/grafana-grafana Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 19:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/grafana-grafana.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Grafana: 8 in the last 7 days and 17 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81843, was published on 12 November 2026. 5 vulnerabilities in the last four weeks, up 25% on the four before (4). ## Counts - Last 7 days: 8 - Last 30 days: 11 - Last 90 days: 17 - All time: 20 (1 critical, 0 exploited in the wild) ## About Grafana Open-source platform for metrics visualization, monitoring, and alerting across multiple data sources. ## Latest Grafana vulnerabilities - [CVE-2026-81843: Grafana Elasticsearch data source denial of service via time range](https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and) (medium, CVSS 6.5, published 12 Nov 2026) - [CVE-2026-106475: Grafana Elasticsearch data source improper authorization in resource proxy](https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-106472: Grafana Prometheus data source path traversal](https://junglewise.ai/threats/cve-2026-106472-grafana-s-prometheus-data-source-passes-the-resource-path) (medium, CVSS 6.3, published 12 Nov 2026) - [CVE-2026-82014: Grafana authorization bypass in team preferences endpoint](https://junglewise.ai/threats/cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-13721: Grafana authorization bypass in Git Sync provisioning API](https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-111000: Grafana privilege escalation in folder move API](https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-110992: Grafana path traversal in Git Sync provisioning](https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-107509: Grafana SQL Expression denial of service via unbounded memory allocation](https://junglewise.ai/threats/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-79656: Grafana sensitive information disclosure in OAuth/OIDC token logging](https://junglewise.ai/threats/cve-2026-79656-a-user-with-read-access-to-grafana-s-server-logs-or-to-a-log) (medium, CVSS 6, published 28 Oct 2026) - [CVE-2026-88858: Grafana denial of service via crafted math expression](https://junglewise.ai/threats/cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by) (medium, CVSS 6.5, published 28 Oct 2026) - [CVE-2026-100105: Grafana authorization bypass via contact point legacy schema downgrade](https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-95502: Grafana Git Sync memory exhaustion via malicious Git server](https://junglewise.ai/threats/cve-2026-95502-a-git-server-that-grafana-s-git-sync-provisioning-is-configured) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-93294: Grafana Azure Monitor resource proxy unrestricted API access](https://junglewise.ai/threats/cve-2026-93294-a-user-with-query-access-to-an-azure-monitor-data-source-can-use) (medium, CVSS 6.3, published 13 Oct 2026) - [CVE-2026-13720: Grafana authorization bypass in dashboard file-provisioning metadata](https://junglewise.ai/threats/cve-2026-13720-an-editor-can-set-file-provisioning-metadata-the-grafana-app) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-13719: Grafana alert rules authorization bypass in API list endpoint](https://junglewise.ai/threats/cve-2026-13719-an-authenticated-user-can-list-alert-rules-stored-in-folders-they) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-81842: Grafana improper authorization in library panel folder move](https://junglewise.ai/threats/cve-2026-81842-an-authenticated-user-with-edit-permission-on-one-folder-can-move) (medium, CVSS 4.3, published 29 Sep 2026) - [CVE-2026-81841: Grafana shared dashboard access token not revoked on pause](https://junglewise.ai/threats/cve-2026-81841-pausing-a-shared-public-dashboard-did-not-revoke-its-access-token) (medium, CVSS 5.3, published 29 Sep 2026) - [CVE-2026-21727: Grafana legacy correlations allow cross-tenant disclosure and deletion](https://junglewise.ai/threats/cve-2026-21727-grafana-legacy-correlations-allow-cross-tenant-disclosure-and) (low, CVSS 3.3, published 15 Apr 2026) - [CVE-2025-12141: In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions…](https://junglewise.ai/threats/cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a) (medium, CVSS 6.5, published 15 Apr 2026) - [CVE-2025-41115: GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability) (critical, CVSS 10, published 21 Nov 2025) ## Most severe Grafana vulnerabilities - [CVE-2025-41115: GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability) (critical, CVSS 10, published 21 Nov 2025) - [CVE-2026-100105: Grafana authorization bypass via contact point legacy schema downgrade](https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-106475: Grafana Elasticsearch data source improper authorization in resource proxy](https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-111000: Grafana privilege escalation in folder move API](https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2025-12141: In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions…](https://junglewise.ai/threats/cve-2025-12141-in-grafana-s-alerting-system-users-with-edit-permissions-for-a) (medium, CVSS 6.5, published 15 Apr 2026) - [CVE-2026-81843: Grafana Elasticsearch data source denial of service via time range](https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and) (medium, CVSS 6.5, published 12 Nov 2026) - [CVE-2026-13721: Grafana authorization bypass in Git Sync provisioning API](https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-110992: Grafana path traversal in Git Sync provisioning](https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-107509: Grafana SQL Expression denial of service via unbounded memory allocation](https://junglewise.ai/threats/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-88858: Grafana denial of service via crafted math expression](https://junglewise.ai/threats/cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by) (medium, CVSS 6.5, published 28 Oct 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 25% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 8 | 0 | 0 | ## Other Grafana technologies - [Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-grafana-enterprise): 4 vulnerabilities - [Grafana OSS](https://junglewise.ai/threats/technologies/grafana-grafana-oss): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grafana vulnerabilities", https://junglewise.ai/threats/technologies/grafana-grafana, 12 November 2026.