{"schema_version":1,"title":"Grafana Labs vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Grafana Labs: 0 in the last 7 days and 6 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-9765, was published on 24 July 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/grafana-labs","json_url":"https://junglewise.ai/threats/vendors/grafana-labs.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/grafana-labs","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":8,"all_time":19,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":6,"last_365_days":19},"latest":[{"cve":"CVE-2026-9765","cvss":7.1,"slug":"cve-2026-9765-grafana-labs-grafana-irm-broken-access-control","title":"Grafana Labs Grafana IRM broken access control","severity":"high","exploited":false,"published_at":"2026-07-24T13:18:31.48+00:00","url":"https://junglewise.ai/threats/cve-2026-9765-grafana-labs-grafana-irm-broken-access-control"},{"cve":"CVE-2026-21729","cvss":7.5,"slug":"cve-2026-21729-grafana-loki-denial-of-service-via-large-query-limits","title":"Grafana Loki Denial of Service via Large Query Limits","severity":"high","exploited":false,"published_at":"2026-07-16T04:17:29.26+00:00","url":"https://junglewise.ai/threats/cve-2026-21729-grafana-loki-denial-of-service-via-large-query-limits"},{"cve":"CVE-2026-8609","cvss":5.3,"slug":"cve-2026-8609-grafana-denial-of-service-in-oauth-login-route","title":"Grafana denial of service in OAuth login route","severity":"medium","exploited":false,"published_at":"2026-07-10T16:16:39.51+00:00","url":"https://junglewise.ai/threats/cve-2026-8609-grafana-denial-of-service-in-oauth-login-route"},{"cve":"CVE-2026-8595","cvss":6.8,"slug":"cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names","title":"Grafana stored XSS in TableNG panel field names","severity":"medium","exploited":false,"published_at":"2026-07-10T16:16:39.4+00:00","url":"https://junglewise.ai/threats/cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names"},{"cve":"CVE-2026-33382","cvss":7.5,"slug":"cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web","title":"Grafana OSS denial of service via oversized request bodies in web.Bind","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web"},{"cve":"CVE-2026-28378","cvss":3.1,"slug":"cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion","title":"Grafana incorrect access control in public dashboard deletion","severity":"low","exploited":false,"published_at":"2026-07-07T22:16:50.607+00:00","url":"https://junglewise.ai/threats/cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion"},{"cve":"CVE-2026-42127","cvss":7.5,"epss":0.0043,"slug":"cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint","title":"Grafana denial of service in public dashboard query endpoint","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:37.43+00:00","url":"https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint"},{"cve":"CVE-2026-42129","cvss":7.7,"epss":0.0044,"slug":"cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource","title":"Grafana Loki datasource plugin path traversal in callResource handler","severity":"high","exploited":false,"published_at":"2026-06-22T14:17:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource"},{"cve":"CVE-2026-28381","cvss":9.6,"slug":"cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write","title":"Grafana Snowflake Datasource arbitrary file read and write","severity":"critical","exploited":false,"published_at":"2026-06-22T14:16:35.82+00:00","url":"https://junglewise.ai/threats/cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write"},{"cve":"CVE-2026-27878","cvss":6.5,"epss":0.0041,"slug":"cve-2026-27878-grafana-tempo-denial-of-service-via-traceql-memory-exhaustion","title":"Grafana Tempo denial of service via TraceQL memory exhaustion","severity":"medium","exploited":false,"published_at":"2026-06-19T19:16:34.897+00:00","url":"https://junglewise.ai/threats/cve-2026-27878-grafana-tempo-denial-of-service-via-traceql-memory-exhaustion"},{"cvss":6.4,"slug":"grafana-operator-privilege-escalation-via-path-traversal-in-jsonnetlib-b86c4005","title":"Grafana Operator privilege escalation via path traversal in jsonnetLib","severity":"medium","exploited":false,"published_at":"2026-06-13T06:30:23+00:00","url":"https://junglewise.ai/threats/grafana-operator-privilege-escalation-via-path-traversal-in-jsonnetlib-b86c4005"},{"cve":"CVE-2026-11769","cvss":4,"epss":0.0036,"slug":"cve-2026-11769-grafana-operator-path-traversal-and-privilege-escalation-in","title":"Grafana Operator path traversal and privilege escalation in jsonnet evaluation","severity":"medium","exploited":false,"published_at":"2026-06-13T06:16:14.38+00:00","url":"https://junglewise.ai/threats/cve-2026-11769-grafana-operator-path-traversal-and-privilege-escalation-in"},{"cve":"CVE-2026-27880","cvss":7.5,"epss":0.0056,"slug":"cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint","title":"Grafana denial of service in OpenFeature evaluation endpoint","severity":"high","exploited":false,"published_at":"2026-03-27T15:16:51.323+00:00","url":"https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint"},{"cve":"CVE-2026-27877","cvss":6.5,"epss":0.004,"slug":"cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public","title":"Grafana information disclosure of data-source passwords in public dashboards","severity":"medium","exploited":false,"published_at":"2026-03-27T15:16:51.05+00:00","url":"https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public"},{"cve":"CVE-2026-27876","cvss":9.1,"epss":0.0128,"slug":"cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise","title":"Grafana remote code execution via SQL Expressions and Enterprise plugin","severity":"critical","exploited":false,"published_at":"2026-03-27T15:16:50.92+00:00","url":"https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise"},{"cve":"CVE-2026-21724","cvss":5.4,"epss":0.0026,"slug":"cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points","title":"Grafana OSS authorization bypass in provisioning contact points API","severity":"medium","exploited":false,"published_at":"2026-03-26T21:31:27+00:00","url":"https://junglewise.ai/threats/cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points"},{"cve":"CVE-2025-41117","cvss":6.8,"epss":0.0024,"slug":"cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api","title":"Grafana XSS in Explore Traces view via Jaeger HTTP API","severity":"medium","exploited":false,"published_at":"2026-02-12T09:30:59+00:00","url":"https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api"},{"cve":"CVE-2026-21721","cvss":8.1,"epss":0.0039,"slug":"cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api","title":"Grafana privilege escalation in dashboard permissions API","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.64+00:00","url":"https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api"},{"cve":"CVE-2026-21720","cvss":7.5,"epss":0.0047,"slug":"cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache","title":"Grafana denial of service via resource exhaustion in avatar cache","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.49+00:00","url":"https://junglewise.ai/threats/cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache"}],"vendor":{"hub":true,"name":"Grafana Labs","slug":"grafana-labs","homepage":"https://grafana.com/","description":"The company behind the Grafana data visualization and monitoring platform.","url":"https://junglewise.ai/threats/vendors/grafana-labs"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-28381","cvss":9.6,"slug":"cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write","title":"Grafana Snowflake Datasource arbitrary file read and write","severity":"critical","exploited":false,"published_at":"2026-06-22T14:16:35.82+00:00","url":"https://junglewise.ai/threats/cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write"},{"cve":"CVE-2026-27876","cvss":9.1,"epss":0.0128,"slug":"cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise","title":"Grafana remote code execution via SQL Expressions and Enterprise plugin","severity":"critical","exploited":false,"published_at":"2026-03-27T15:16:50.92+00:00","url":"https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise"},{"cve":"CVE-2026-21721","cvss":8.1,"epss":0.0039,"slug":"cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api","title":"Grafana privilege escalation in dashboard permissions API","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.64+00:00","url":"https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api"},{"cve":"CVE-2026-42129","cvss":7.7,"epss":0.0044,"slug":"cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource","title":"Grafana Loki datasource plugin path traversal in callResource handler","severity":"high","exploited":false,"published_at":"2026-06-22T14:17:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource"},{"cve":"CVE-2026-27880","cvss":7.5,"epss":0.0056,"slug":"cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint","title":"Grafana denial of service in OpenFeature evaluation endpoint","severity":"high","exploited":false,"published_at":"2026-03-27T15:16:51.323+00:00","url":"https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint"},{"cve":"CVE-2026-21720","cvss":7.5,"epss":0.0047,"slug":"cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache","title":"Grafana denial of service via resource exhaustion in avatar cache","severity":"high","exploited":false,"published_at":"2026-01-27T09:15:48.49+00:00","url":"https://junglewise.ai/threats/cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache"},{"cve":"CVE-2026-42127","cvss":7.5,"epss":0.0043,"slug":"cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint","title":"Grafana denial of service in public dashboard query endpoint","severity":"high","exploited":false,"published_at":"2026-06-22T18:16:37.43+00:00","url":"https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint"},{"cve":"CVE-2026-21729","cvss":7.5,"slug":"cve-2026-21729-grafana-loki-denial-of-service-via-large-query-limits","title":"Grafana Loki Denial of Service via Large Query Limits","severity":"high","exploited":false,"published_at":"2026-07-16T04:17:29.26+00:00","url":"https://junglewise.ai/threats/cve-2026-21729-grafana-loki-denial-of-service-via-large-query-limits"},{"cve":"CVE-2026-33382","cvss":7.5,"slug":"cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web","title":"Grafana OSS denial of service via oversized request bodies in web.Bind","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web"},{"cve":"CVE-2026-9765","cvss":7.1,"slug":"cve-2026-9765-grafana-labs-grafana-irm-broken-access-control","title":"Grafana Labs Grafana IRM broken access control","severity":"high","exploited":false,"published_at":"2026-07-24T13:18:31.48+00:00","url":"https://junglewise.ai/threats/cve-2026-9765-grafana-labs-grafana-irm-broken-access-control"}],"generated_at":"2026-09-26T16:07:00.132667+00:00","technologies":[{"name":"Grafana Labs Grafana OSS","slug":"grafana-oss","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/grafana-oss"},{"name":"Grafana Labs Grafana Enterprise","slug":"grafana-enterprise","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/grafana-enterprise"}]}