grafana vulnerabilities

CVEs per yearBy the year they were published

1. 20217
2. 202222
3. 202315
4. 202510
5. 202670
6. 202616

Known exploitedNewest addition to KEV first

• CVE-2021-43798

  Grafana path traversal

  grafana · grafana

  ExploitedHigh7.5
• CVE-2021-39226

  Snapshot authentication bypass in grafana

  grafana · grafana

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-81938

  Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir

  Grafana · Enterprise Metrics (GEM)

  High7.7
• CVE-2026-79656

  OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

  Grafana · Grafana OSS

  Medium6.0
• CVE-2026-103506

  SSO settings authorization bypass

  Grafana · Grafana Enterprise

  High8.9
• CVE-2026-88858

  Server-side expression parser denial of service

  Grafana · Grafana OSS

  Medium6.5
• CVE-2026-88967

  Azure Monitor access token disclosure via SSRF

  Grafana · Grafana Enterprise

  High7.7
• CVE-2026-100105

  Alerting contact point authorization bypass via schema downgrade

  Grafana · Grafana Enterprise

  High7.7
• CVE-2026-16491

  CVE-2026-16491 CVE Record

  Grafana · Grafana Enterprise

  Medium6.5
• CVE-2026-92539

  Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

  Grafana · Grafana Enterprise

  Medium6.7
• CVE-2026-9703

  Viewer role can create, modify and delete Loki alerting rules

  Grafana · Grafana Enterprise

  High7.1
• CVE-2026-33374

  Unbounded memory allocation in the Prometheus rule conversion API

  Grafana · Grafana Enterprise

  Medium6.5