{"schema_version":1,"title":"Grafana Labs Grafana OSS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Grafana Labs Grafana OSS: 0 in the last 7 days and 4 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-8609, was published on 10 July 2026.","url":"https://junglewise.ai/threats/technologies/grafana-oss","json_url":"https://junglewise.ai/threats/technologies/grafana-oss.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/grafana-oss","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":12,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":4,"last_365_days":12},"latest":[{"cve":"CVE-2026-8609","cvss":5.3,"slug":"cve-2026-8609-grafana-denial-of-service-in-oauth-login-route","title":"Grafana denial of service in OAuth login route","severity":"medium","exploited":false,"published_at":"2026-07-10T16:16:39.51+00:00","url":"https://junglewise.ai/threats/cve-2026-8609-grafana-denial-of-service-in-oauth-login-route"},{"cve":"CVE-2026-8595","cvss":6.8,"slug":"cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names","title":"Grafana stored XSS in TableNG panel field names","severity":"medium","exploited":false,"published_at":"2026-07-10T16:16:39.4+00:00","url":"https://junglewise.ai/threats/cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names"},{"cve":"CVE-2026-33382","cvss":7.5,"slug":"cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web","title":"Grafana OSS denial of service via oversized request bodies in web.Bind","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web"},{"cve":"CVE-2026-28378","cvss":3.1,"slug":"cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion","title":"Grafana incorrect access control in public dashboard deletion","severity":"low","exploited":false,"published_at":"2026-07-07T22:16:50.607+00:00","url":"https://junglewise.ai/threats/cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion"},{"cve":"CVE-2026-42127","cvss":7.5,"epss":0.0043,"slug":"cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint","title":"Grafana denial of service in public dashboard query endpoint","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:37.43+00:00","url":"https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint"},{"cve":"CVE-2026-42129","cvss":7.7,"epss":0.0044,"slug":"cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource","title":"Grafana Loki datasource plugin path traversal in callResource handler","severity":"high","exploited":false,"published_at":"2026-06-22T14:17:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource"},{"cve":"CVE-2026-27880","cvss":7.5,"epss":0.0056,"slug":"cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint","title":"Grafana denial of service in OpenFeature evaluation endpoint","severity":"high","exploited":false,"published_at":"2026-03-27T15:16:51.323+00:00","url":"https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint"},{"cve":"CVE-2026-27877","cvss":6.5,"epss":0.004,"slug":"cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public","title":"Grafana information disclosure of data-source passwords in public dashboards","severity":"medium","exploited":false,"published_at":"2026-03-27T15:16:51.05+00:00","url":"https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public"},{"cve":"CVE-2026-27876","cvss":9.1,"epss":0.0128,"slug":"cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise","title":"Grafana remote code execution via SQL Expressions and Enterprise plugin","severity":"critical","exploited":false,"published_at":"2026-03-27T15:16:50.92+00:00","url":"https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise"},{"cve":"CVE-2026-21724","cvss":5.4,"epss":0.0026,"slug":"cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points","title":"Grafana OSS authorization bypass in provisioning contact points API","severity":"medium","exploited":false,"published_at":"2026-03-26T21:31:27+00:00","url":"https://junglewise.ai/threats/cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points"},{"cve":"CVE-2026-21721","cvss":8.1,"epss":0.0039,"slug":"cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api","title":"Grafana privilege escalation in dashboard permissions API","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.64+00:00","url":"https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api"},{"cve":"CVE-2026-21720","cvss":7.5,"epss":0.0047,"slug":"cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache","title":"Grafana denial of service via resource exhaustion in avatar cache","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.49+00:00","url":"https://junglewise.ai/threats/cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Grafana Labs Grafana Enterprise","slug":"grafana-enterprise","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/grafana-enterprise"}],"technology":{"hub":true,"name":"Grafana Labs Grafana OSS","slug":"grafana-oss","vendor":{"name":"Grafana Labs","slug":"grafana-labs","url":"https://junglewise.ai/threats/vendors/grafana-labs"},"aliases":[],"category":"application","homepage":"https://grafana.com/oss/grafana/","repo_url":"https://github.com/grafana/grafana","description":"An open-source platform for monitoring and observability that allows users to query, visualize, and alert on metrics and logs.","url":"https://junglewise.ai/threats/technologies/grafana-oss"},"most_severe":[{"cve":"CVE-2026-27876","cvss":9.1,"epss":0.0128,"slug":"cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise","title":"Grafana remote code execution via SQL Expressions and Enterprise plugin","severity":"critical","exploited":false,"published_at":"2026-03-27T15:16:50.92+00:00","url":"https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise"},{"cve":"CVE-2026-21721","cvss":8.1,"epss":0.0039,"slug":"cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api","title":"Grafana privilege escalation in dashboard permissions API","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.64+00:00","url":"https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api"},{"cve":"CVE-2026-42129","cvss":7.7,"epss":0.0044,"slug":"cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource","title":"Grafana Loki datasource plugin path traversal in callResource handler","severity":"high","exploited":false,"published_at":"2026-06-22T14:17:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource"},{"cve":"CVE-2026-27880","cvss":7.5,"epss":0.0056,"slug":"cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint","title":"Grafana denial of service in OpenFeature evaluation endpoint","severity":"high","exploited":false,"published_at":"2026-03-27T15:16:51.323+00:00","url":"https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint"},{"cve":"CVE-2026-21720","cvss":7.5,"epss":0.0047,"slug":"cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache","title":"Grafana denial of service via resource exhaustion in avatar cache","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.49+00:00","url":"https://junglewise.ai/threats/cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache"},{"cve":"CVE-2026-42127","cvss":7.5,"epss":0.0043,"slug":"cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint","title":"Grafana denial of service in public dashboard query endpoint","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:37.43+00:00","url":"https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint"},{"cve":"CVE-2026-33382","cvss":7.5,"slug":"cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web","title":"Grafana OSS denial of service via oversized request bodies in web.Bind","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web"},{"cve":"CVE-2026-8595","cvss":6.8,"slug":"cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names","title":"Grafana stored XSS in TableNG panel field names","severity":"medium","exploited":false,"published_at":"2026-07-10T16:16:39.4+00:00","url":"https://junglewise.ai/threats/cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names"},{"cve":"CVE-2026-27877","cvss":6.5,"epss":0.004,"slug":"cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public","title":"Grafana information disclosure of data-source passwords in public dashboards","severity":"medium","exploited":false,"published_at":"2026-03-27T15:16:51.05+00:00","url":"https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public"},{"cve":"CVE-2026-21724","cvss":5.4,"epss":0.0026,"slug":"cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points","title":"Grafana OSS authorization bypass in provisioning contact points API","severity":"medium","exploited":false,"published_at":"2026-03-26T21:31:27+00:00","url":"https://junglewise.ai/threats/cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points"}],"generated_at":"2026-09-26T15:07:00.181821+00:00"}