# Grafana Labs vulnerabilities Source: https://junglewise.ai/threats/vendors/grafana-labs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/grafana-labs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Grafana Labs: 4 in the last 7 days and 8 in the last 90 days, 4 of them critical and 2 exploited in the wild. The most recent, CVE-2026-14242, was published on 11 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. 3 technologies have a page of their own. ## Counts - Last 7 days: 4 - Last 30 days: 6 - Last 90 days: 8 - All time: 29 (4 critical, 2 exploited in the wild) ## About Grafana Labs Software company that develops Grafana, an open source platform for monitoring and observability. ## Latest Grafana Labs vulnerabilities - [CVE-2026-14242: Grafana authorization bypass in Git Sync](https://junglewise.ai/threats/cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-111024: Grafana authorization bypass in Git Sync managed resources](https://junglewise.ai/threats/cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-110289: Grafana server-side request forgery via Git Sync configuration](https://junglewise.ai/threats/cve-2026-110289-a-user-with-the-organization-admin-role-could-point-the-server) (medium, CVSS 5.5, published 11 Nov 2026) - [CVE-2026-102589: Grafana authentication bypass in image renderer](https://junglewise.ai/threats/cve-2026-102589-when-independent-grafana-instances-share-the-same-rendering) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-88967: Grafana Azure Monitor SSRF with token disclosure](https://junglewise.ai/threats/cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-16491: Grafana RBAC authorization bypass in deleted dashboard listings](https://junglewise.ai/threats/cve-2026-16491-grafana-s-rbac-service-ignored-the-requested-folder-when-checking) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-33374: Grafana unbounded memory allocation in Prometheus rule conversion API](https://junglewise.ai/threats/cve-2026-33374-the-prometheus-rule-conversion-api-endpoints-in-grafana-do-not) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-15577: Grafana Git Sync authorization bypass in status subresource](https://junglewise.ai/threats/cve-2026-15577-a-user-or-service-account-with-read-only-access-to-git-sync) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-9765: Grafana Labs Grafana IRM broken access control](https://junglewise.ai/threats/cve-2026-9765-grafana-labs-grafana-irm-broken-access-control) (high, CVSS 7.1, published 24 Jul 2026) - [CVE-2026-21729: Grafana Loki Denial of Service via Large Query Limits](https://junglewise.ai/threats/cve-2026-21729-grafana-loki-denial-of-service-via-large-query-limits) (high, CVSS 7.5, published 16 Jul 2026) - [CVE-2026-8609: Grafana denial of service in OAuth login route](https://junglewise.ai/threats/cve-2026-8609-grafana-denial-of-service-in-oauth-login-route) (medium, CVSS 5.3, published 10 Jul 2026) - [CVE-2026-8595: Grafana stored XSS in TableNG panel field names](https://junglewise.ai/threats/cve-2026-8595-grafana-stored-xss-in-tableng-panel-field-names) (medium, CVSS 6.8, published 10 Jul 2026) - [CVE-2026-33382: Grafana OSS denial of service via oversized request bodies in web.Bind](https://junglewise.ai/threats/cve-2026-33382-grafana-oss-denial-of-service-via-oversized-request-bodies-in-web) (high, CVSS 7.5, published 10 Jul 2026) - [CVE-2026-28378: Grafana incorrect access control in public dashboard deletion](https://junglewise.ai/threats/cve-2026-28378-grafana-incorrect-access-control-in-public-dashboard-deletion) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-42127: Grafana denial of service in public dashboard query endpoint](https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint) (high, CVSS 7.5, published 22 Jun 2026) - [CVE-2026-42129: Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2026-28381: Grafana Snowflake Datasource arbitrary file read and write](https://junglewise.ai/threats/cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write) (critical, CVSS 9.6, published 22 Jun 2026) - [CVE-2026-27878: Grafana Tempo denial of service via TraceQL memory exhaustion](https://junglewise.ai/threats/cve-2026-27878-grafana-tempo-denial-of-service-via-traceql-memory-exhaustion) (medium, CVSS 6.5, published 19 Jun 2026) - [Grafana Operator privilege escalation via path traversal in jsonnetLib](https://junglewise.ai/threats/grafana-operator-privilege-escalation-via-path-traversal-in-jsonnetlib-b86c4005) (medium, CVSS 6.4, published 13 Jun 2026) - [CVE-2026-11769: Grafana Operator path traversal and privilege escalation in jsonnet evaluation](https://junglewise.ai/threats/cve-2026-11769-grafana-operator-path-traversal-and-privilege-escalation-in) (medium, CVSS 4, published 13 Jun 2026) - [CVE-2026-27880: Grafana denial of service in OpenFeature evaluation endpoint](https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-27877: Grafana information disclosure of data-source passwords in public dashboards](https://junglewise.ai/threats/cve-2026-27877-grafana-information-disclosure-of-data-source-passwords-in-public) (medium, CVSS 6.5, published 27 Mar 2026) - [CVE-2026-27876: Grafana remote code execution via SQL Expressions and Enterprise plugin](https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise) (critical, CVSS 9.1, published 27 Mar 2026) - [CVE-2026-21724: Grafana OSS authorization bypass in provisioning contact points API](https://junglewise.ai/threats/cve-2026-21724-grafana-oss-authorization-bypass-in-provisioning-contact-points) (medium, CVSS 5.4, published 26 Mar 2026) - [CVE-2025-41117: Grafana XSS in Explore Traces view via Jaeger HTTP API](https://junglewise.ai/threats/cve-2025-41117-grafana-xss-in-explore-traces-view-via-jaeger-http-api) (medium, CVSS 6.8, published 12 Feb 2026) ## Most severe Grafana Labs vulnerabilities - [CVE-2021-39226: Authentication bypass for viewing and deletions of snapshots](https://junglewise.ai/threats/cve-2021-39226-grafana-authentication-bypass-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 5 Oct 2021) - [CVE-2021-43798: Grafana path traversal](https://junglewise.ai/threats/cve-2021-43798-grafana-path-traversal-in-plugin-assets) (critical, exploited in the wild, CVSS 3.1, published 1 Feb 2024) - [CVE-2026-28381: Grafana Snowflake Datasource arbitrary file read and write](https://junglewise.ai/threats/cve-2026-28381-grafana-snowflake-datasource-arbitrary-file-read-and-write) (critical, CVSS 9.6, published 22 Jun 2026) - [CVE-2026-27876: Grafana remote code execution via SQL Expressions and Enterprise plugin](https://junglewise.ai/threats/cve-2026-27876-grafana-remote-code-execution-via-sql-expressions-and-enterprise) (critical, CVSS 9.1, published 27 Mar 2026) - [CVE-2026-21721: Grafana privilege escalation in dashboard permissions API](https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api) (high, CVSS 8.1, published 27 Jan 2026) - [CVE-2026-42129: Grafana Loki datasource plugin path traversal in callResource handler](https://junglewise.ai/threats/cve-2026-42129-grafana-loki-datasource-plugin-path-traversal-in-callresource) (high, CVSS 7.7, published 22 Jun 2026) - [CVE-2026-88967: Grafana Azure Monitor SSRF with token disclosure](https://junglewise.ai/threats/cve-2026-88967-a-user-with-query-access-to-an-azure-monitor-data-source-in) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-27880: Grafana denial of service in OpenFeature evaluation endpoint](https://junglewise.ai/threats/cve-2026-27880-grafana-denial-of-service-in-openfeature-evaluation-endpoint) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-21720: Grafana denial of service via resource exhaustion in avatar cache](https://junglewise.ai/threats/cve-2026-21720-grafana-denial-of-service-via-resource-exhaustion-in-avatar-cache) (high, CVSS 7.5, published 27 Jan 2026) - [CVE-2026-42127: Grafana denial of service in public dashboard query endpoint](https://junglewise.ai/threats/cve-2026-42127-grafana-denial-of-service-in-public-dashboard-query-endpoint) (high, CVSS 7.5, published 22 Jun 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## Grafana Labs technologies - [Grafana Labs Grafana](https://junglewise.ai/threats/technologies/grafana): 12 vulnerabilities - [Grafana Labs Grafana OSS](https://junglewise.ai/threats/technologies/grafana-oss): 11 vulnerabilities - [Grafana Labs Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-enterprise): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grafana Labs vulnerabilities", https://junglewise.ai/threats/vendors/grafana-labs, 13 November 2026.