Grafana OSS vulnerabilities and CVEs

Known vulnerabilities affecting Grafana OSS, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

6 vulnerabilities tracked. 1 with public exploit code.

8.9 An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions… CVE-2026-103506 28 Oct 2026
7.7 A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that… CVE-2026-88967 28 Oct 2026
7.7 A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's… CVE-2026-100105 Exploit code 28 Oct 2026
6.5 A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). CVE-2026-88858 28 Oct 2026
6.5 Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. CVE-2026-16491 27 Oct 2026
6.0 A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and… CVE-2026-79656 28 Oct 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Grafana OSS is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here