# Grafana vulnerabilities Source: https://junglewise.ai/threats/vendors/grafana Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/grafana.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in Grafana: 10 in the last 7 days and 26 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81843, was published on 12 November 2026. 10 vulnerabilities in the last four weeks, up 150% on the four before (4). 3 technologies have a page of their own. ## Counts - Last 7 days: 10 - Last 30 days: 17 - Last 90 days: 26 - All time: 33 (2 critical, 0 exploited in the wild) ## About Grafana Grafana is an open-source provider of observability and data visualization software. ## Latest Grafana vulnerabilities - [CVE-2026-81843: Grafana Elasticsearch data source denial of service via time range](https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and) (medium, CVSS 6.5, published 12 Nov 2026) - [CVE-2026-107365: Grafana Cloud Monitoring plugin resource proxy bypass](https://junglewise.ai/threats/cve-2026-107365-a-user-with-query-access-to-a-google-cloud-monitoring-data) (info, published 12 Nov 2026) - [CVE-2026-106475: Grafana Elasticsearch data source improper authorization in resource proxy](https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-106472: Grafana Prometheus data source path traversal](https://junglewise.ai/threats/cve-2026-106472-grafana-s-prometheus-data-source-passes-the-resource-path) (medium, CVSS 6.3, published 12 Nov 2026) - [CVE-2026-82014: Grafana authorization bypass in team preferences endpoint](https://junglewise.ai/threats/cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-13721: Grafana authorization bypass in Git Sync provisioning API](https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-111000: Grafana privilege escalation in folder move API](https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-110992: Grafana path traversal in Git Sync provisioning](https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-107509: Grafana SQL Expression denial of service via unbounded memory allocation](https://junglewise.ai/threats/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-33379: Grafana authorization bypass in dashboard snapshots](https://junglewise.ai/threats/cve-2026-33379-a-user-with-any-role-including-viewer-or-a-service-account-with) (high, CVSS 8.5, published 6 Nov 2026) - [CVE-2026-81938: Grafana Mimir Alertmanager local file disclosure via receiver config](https://junglewise.ai/threats/cve-2026-81938-grafana-mimir-s-alertmanager-rejects-tenant-supplied-receiver) (high, CVSS 7.7, published 2 Nov 2026) - [CVE-2026-79656: Grafana sensitive information disclosure in OAuth/OIDC token logging](https://junglewise.ai/threats/cve-2026-79656-a-user-with-read-access-to-grafana-s-server-logs-or-to-a-log) (medium, CVSS 6, published 28 Oct 2026) - [CVE-2026-88858: Grafana denial of service via crafted math expression](https://junglewise.ai/threats/cve-2026-88858-a-user-with-the-viewer-role-in-grafana-can-crash-the-server-by) (medium, CVSS 6.5, published 28 Oct 2026) - [CVE-2026-103506: Grafana SSO settings authorization bypass](https://junglewise.ai/threats/cve-2026-103506-an-authenticated-user-in-grafana-can-read-sso-client-secrets-and) (info, published 28 Oct 2026) - [CVE-2026-100105: Grafana authorization bypass via contact point legacy schema downgrade](https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-92539: Grafana SCIM API insecure direct object reference across organizations](https://junglewise.ai/threats/cve-2026-92539-a-service-account-with-user-management-permissions-in-one) (medium, CVSS 6.7, published 20 Oct 2026) - [CVE-2026-9703: Grafana data source proxy authorization bypass in Loki rules API](https://junglewise.ai/threats/cve-2026-9703-grafana-s-data-source-proxy-did-not-apply-role-based-access) (high, CVSS 7.1, published 15 Oct 2026) - [CVE-2026-95502: Grafana Git Sync memory exhaustion via malicious Git server](https://junglewise.ai/threats/cve-2026-95502-a-git-server-that-grafana-s-git-sync-provisioning-is-configured) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-93294: Grafana Azure Monitor resource proxy unrestricted API access](https://junglewise.ai/threats/cve-2026-93294-a-user-with-query-access-to-an-azure-monitor-data-source-can-use) (medium, CVSS 6.3, published 13 Oct 2026) - [CVE-2026-13720: Grafana authorization bypass in dashboard file-provisioning metadata](https://junglewise.ai/threats/cve-2026-13720-an-editor-can-set-file-provisioning-metadata-the-grafana-app) (medium, CVSS 5.4, published 30 Sep 2026) - [CVE-2026-13719: Grafana alert rules authorization bypass in API list endpoint](https://junglewise.ai/threats/cve-2026-13719-an-authenticated-user-can-list-alert-rules-stored-in-folders-they) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-81842: Grafana improper authorization in library panel folder move](https://junglewise.ai/threats/cve-2026-81842-an-authenticated-user-with-edit-permission-on-one-folder-can-move) (medium, CVSS 4.3, published 29 Sep 2026) - [CVE-2026-81841: Grafana shared dashboard access token not revoked on pause](https://junglewise.ai/threats/cve-2026-81841-pausing-a-shared-public-dashboard-did-not-revoke-its-access-token) (medium, CVSS 5.3, published 29 Sep 2026) - [CVE-2026-19475: Grafana SQL Data Source Plugin denial of service via $__timeGroup macro](https://junglewise.ai/threats/cve-2026-19475-grafana-sql-data-source-plugin-denial-of-service-via-timegroup) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-75889: Grafana Alloy arbitrary file read via ServiceMonitor bearerTokenFile](https://junglewise.ai/threats/cve-2026-75889-grafana-alloy-arbitrary-file-read-via-servicemonitor) (high, CVSS 7.7, published 27 Aug 2026) ## Most severe Grafana vulnerabilities - [CVE-2025-41115: GO-2025-4153 - Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana](https://junglewise.ai/threats/cve-2025-41115-grafana-incorrect-privilege-assignment-vulnerability) (critical, CVSS 10, published 21 Nov 2025) - [CVE-2026-63087: Grafana OnCall authentication bypass in plugin install endpoint](https://junglewise.ai/threats/cve-2026-63087-grafana-oncall-authentication-bypass-in-plugin-install-endpoint) (critical, CVSS 9.8, published 16 Jul 2026) - [CVE-2026-33379: Grafana authorization bypass in dashboard snapshots](https://junglewise.ai/threats/cve-2026-33379-a-user-with-any-role-including-viewer-or-a-service-account-with) (high, CVSS 8.5, published 6 Nov 2026) - [CVE-2026-75889: Grafana Alloy arbitrary file read via ServiceMonitor bearerTokenFile](https://junglewise.ai/threats/cve-2026-75889-grafana-alloy-arbitrary-file-read-via-servicemonitor) (high, CVSS 7.7, published 27 Aug 2026) - [CVE-2026-81938: Grafana Mimir Alertmanager local file disclosure via receiver config](https://junglewise.ai/threats/cve-2026-81938-grafana-mimir-s-alertmanager-rejects-tenant-supplied-receiver) (high, CVSS 7.7, published 2 Nov 2026) - [CVE-2026-100105: Grafana authorization bypass via contact point legacy schema downgrade](https://junglewise.ai/threats/cve-2026-100105-a-user-with-permission-to-edit-contact-points-but-not-their) (high, CVSS 7.7, published 28 Oct 2026) - [CVE-2026-9703: Grafana data source proxy authorization bypass in Loki rules API](https://junglewise.ai/threats/cve-2026-9703-grafana-s-data-source-proxy-did-not-apply-role-based-access) (high, CVSS 7.1, published 15 Oct 2026) - [CVE-2026-106475: Grafana Elasticsearch data source improper authorization in resource proxy](https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-111000: Grafana privilege escalation in folder move API](https://junglewise.ai/threats/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-92539: Grafana SCIM API insecure direct object reference across organizations](https://junglewise.ai/threats/cve-2026-92539-a-service-account-with-user-management-permissions-in-one) (medium, CVSS 6.7, published 20 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 150% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 9 | 0 | 0 | ## Grafana technologies - [Grafana](https://junglewise.ai/threats/technologies/grafana-grafana): 20 vulnerabilities - [Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-grafana-enterprise): 4 vulnerabilities - [Grafana OSS](https://junglewise.ai/threats/technologies/grafana-grafana-oss): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grafana vulnerabilities", https://junglewise.ai/threats/vendors/grafana, 13 November 2026.