{"schema_version":1,"title":"Grafana Labs Grafana vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Grafana Labs Grafana: 4 in the last 7 days and 8 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-14242, was published on 11 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/grafana","json_url":"https://junglewise.ai/threats/technologies/grafana.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/grafana","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":12,"critical":2,"exploited":2,"last_7_days":4,"last_30_days":6,"last_90_days":8,"last_365_days":10},"latest":[{"cve":"CVE-2026-14242","cvss":6.5,"slug":"cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git","title":"Grafana authorization bypass in Git Sync","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:22.85+00:00","url":"https://junglewise.ai/threats/cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git"},{"cve":"CVE-2026-111024","cvss":7.1,"slug":"cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder","title":"Grafana authorization bypass in Git Sync managed resources","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:14.63+00:00","url":"https://junglewise.ai/threats/cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder"},{"cve":"CVE-2026-110289","cvss":5.5,"slug":"cve-2026-110289-a-user-with-the-organization-admin-role-could-point-the-server","title":"Grafana server-side request forgery via Git Sync configuration","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:14.23+00:00","url":"https://junglewise.ai/threats/cve-2026-110289-a-user-with-the-organization-admin-role-could-point-the-server"},{"cve":"CVE-2026-102589","cvss":7.1,"slug":"cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering","title":"Grafana authentication bypass in image renderer","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:12.447+00:00","url":"https://junglewise.ai/threats/cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering"},{"cve":"CVE-2026-88967","cvss":7.7,"slug":"cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in","title":"Grafana Azure Monitor SSRF with token disclosure","severity":"high","exploited":false,"published_at":"2026-10-28T17:18:46.09+00:00","url":"https://junglewise.ai/threats/cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in"},{"cve":"CVE-2026-16491","cvss":6.5,"slug":"cve-2026-16491-grafana-s-rbac-service-ignored-the-requested-folder-when-checking","title":"Grafana RBAC authorization bypass in deleted dashboard listings","severity":"medium","exploited":false,"published_at":"2026-10-27T18:17:37.053+00:00","url":"https://junglewise.ai/threats/cve-2026-16491-grafana-s-rbac-service-ignored-the-requested-folder-when-checking"},{"cve":"CVE-2026-33374","cvss":6.5,"epss":0.0037,"slug":"cve-2026-33374-the-prometheus-rule-conversion-api-endpoints-in-grafana-do-not","title":"Grafana unbounded memory allocation in Prometheus rule conversion API","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:23.72+00:00","url":"https://junglewise.ai/threats/cve-2026-33374-the-prometheus-rule-conversion-api-endpoints-in-grafana-do-not"},{"cve":"CVE-2026-15577","cvss":6.5,"epss":0.0027,"slug":"cve-2026-15577-a-user-or-service-account-with-read-only-access-to-git-sync","title":"Grafana Git Sync authorization bypass in status subresource","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:23.073+00:00","url":"https://junglewise.ai/threats/cve-2026-15577-a-user-or-service-account-with-read-only-access-to-git-sync"},{"cve":"CVE-2026-27877","cvss":6.5,"epss":0.004,"slug":"cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public","title":"Grafana information disclosure of data-source passwords in public dashboards","severity":"medium","exploited":false,"published_at":"2026-03-27T15:16:51.05+00:00","url":"https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public"},{"cve":"CVE-2025-41117","cvss":6.8,"epss":0.0024,"slug":"cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api","title":"Grafana XSS in Explore Traces view via Jaeger HTTP API","severity":"medium","exploited":false,"published_at":"2026-02-12T09:30:59+00:00","url":"https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api"},{"cve":"CVE-2021-43798","cvss":3.1,"epss":0.885,"slug":"cve-2021-43798-grafana-path-traversal-in-plugin-assets","title":"Grafana path traversal","severity":"critical","exploited":true,"published_at":"2024-02-01T00:16:10+00:00","url":"https://junglewise.ai/threats/cve-2021-43798-grafana-path-traversal-in-plugin-assets"},{"cve":"CVE-2021-39226","cvss":3.1,"epss":0.9993,"slug":"cve-2021-39226-grafana-authentication-bypass-vulnerability","title":"Authentication bypass for viewing and deletions of snapshots","severity":"critical","exploited":true,"published_at":"2021-10-05T20:24:02+00:00","url":"https://junglewise.ai/threats/cve-2021-39226-grafana-authentication-bypass-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":4}],"related":[{"name":"Grafana Labs Grafana OSS","slug":"grafana-oss","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/grafana-oss"},{"name":"Grafana Labs Grafana Enterprise","slug":"grafana-enterprise","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/grafana-enterprise"}],"technology":{"hub":true,"name":"Grafana Labs Grafana","slug":"grafana","vendor":{"hub":true,"name":"Grafana Labs","slug":"grafana-labs","url":"https://junglewise.ai/threats/vendors/grafana-labs"},"aliases":["grafana-labs-grafana"],"category":"software-application","homepage":"https://grafana.com/","repo_url":"https://github.com/grafana/grafana","description":"Grafana is an open-source visualization and monitoring platform for time-series data.","url":"https://junglewise.ai/threats/technologies/grafana"},"most_severe":[{"cve":"CVE-2021-39226","cvss":3.1,"epss":0.9993,"slug":"cve-2021-39226-grafana-authentication-bypass-vulnerability","title":"Authentication bypass for viewing and deletions of snapshots","severity":"critical","exploited":true,"published_at":"2021-10-05T20:24:02+00:00","url":"https://junglewise.ai/threats/cve-2021-39226-grafana-authentication-bypass-vulnerability"},{"cve":"CVE-2021-43798","cvss":3.1,"epss":0.885,"slug":"cve-2021-43798-grafana-path-traversal-in-plugin-assets","title":"Grafana path traversal","severity":"critical","exploited":true,"published_at":"2024-02-01T00:16:10+00:00","url":"https://junglewise.ai/threats/cve-2021-43798-grafana-path-traversal-in-plugin-assets"},{"cve":"CVE-2026-88967","cvss":7.7,"slug":"cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in","title":"Grafana Azure Monitor SSRF with token disclosure","severity":"high","exploited":false,"published_at":"2026-10-28T17:18:46.09+00:00","url":"https://junglewise.ai/threats/cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in"},{"cve":"CVE-2026-111024","cvss":7.1,"slug":"cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder","title":"Grafana authorization bypass in Git Sync managed resources","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:14.63+00:00","url":"https://junglewise.ai/threats/cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder"},{"cve":"CVE-2026-102589","cvss":7.1,"slug":"cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering","title":"Grafana authentication bypass in image renderer","severity":"high","exploited":false,"published_at":"2026-11-11T15:17:12.447+00:00","url":"https://junglewise.ai/threats/cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering"},{"cve":"CVE-2025-41117","cvss":6.8,"epss":0.0024,"slug":"cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api","title":"Grafana XSS in Explore Traces view via Jaeger HTTP API","severity":"medium","exploited":false,"published_at":"2026-02-12T09:30:59+00:00","url":"https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api"},{"cve":"CVE-2026-27877","cvss":6.5,"epss":0.004,"slug":"cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public","title":"Grafana information disclosure of data-source passwords in public dashboards","severity":"medium","exploited":false,"published_at":"2026-03-27T15:16:51.05+00:00","url":"https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public"},{"cve":"CVE-2026-33374","cvss":6.5,"epss":0.0037,"slug":"cve-2026-33374-the-prometheus-rule-conversion-api-endpoints-in-grafana-do-not","title":"Grafana unbounded memory allocation in Prometheus rule conversion API","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:23.72+00:00","url":"https://junglewise.ai/threats/cve-2026-33374-the-prometheus-rule-conversion-api-endpoints-in-grafana-do-not"},{"cve":"CVE-2026-15577","cvss":6.5,"epss":0.0027,"slug":"cve-2026-15577-a-user-or-service-account-with-read-only-access-to-git-sync","title":"Grafana Git Sync authorization bypass in status subresource","severity":"medium","exploited":false,"published_at":"2026-10-13T18:17:23.073+00:00","url":"https://junglewise.ai/threats/cve-2026-15577-a-user-or-service-account-with-read-only-access-to-git-sync"},{"cve":"CVE-2026-14242","cvss":6.5,"slug":"cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git","title":"Grafana authorization bypass in Git Sync","severity":"medium","exploited":false,"published_at":"2026-11-11T15:17:22.85+00:00","url":"https://junglewise.ai/threats/cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}