Threat database

CVE-2026-19854 is a vulnerability in the Grafana Clickhouse Datasource plugin version 3.1.0 where the Native protocol connection ignores TLS requests when using PDC or secure SOCKS proxies. This results in cleartext transmission of sensitive information such as usernames, passwords, queries, and results. Additionally, the server certificate is never verified, and client certificates configured are not sent.

CVE-2026-19197 is a medium severity vulnerability in Grafana OSS where a user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same instance. Additionally, such a user can recover a snapshot's secret delete key using only its public share key, indicating broken access control.

CVE-2026-17033 is a cross-site scripting (XSS) vulnerability in Grafana OSS that allows an authenticated attacker with Editor access or alert.instances.external:write permission to inject malicious JavaScript via a crafted external Alertmanager alert. The vulnerability arises because Grafana renders the alert.generatorURL directly without proper URL-scheme sanitization or a safe-protocol allowlist. When a user with read access clicks the 'See source' link, the attacker's script executes in the context of the user's Grafana session.

CVE-2026-17183 is a high-severity vulnerability in Grafana OSS where an authenticated user with permission to create or edit alert rules can bypass datasource query authorization. By marking an alert rule query as a server-side expression referencing a real datasource UID, the user can access data through Grafana's datasource credentials without proper permission. This incorrect authorization flaw can expose sensitive data to unauthorized users.

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

CVE-2026-9765 is a high-severity vulnerability in Grafana IRM version 1.0.0 involving broken access controls. This flaw allows users with limited privileges to bypass access control mechanisms and gain unauthorized access to resources or perform actions beyond their permissions. The vulnerability can lead to unauthorized data access, privilege escalation attempts, and potential account takeovers. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape the plugin's resource sandbox and access administrative Loki endpoints (e.g. /config, /services, /ready) to extract sensitive backend configuration and internal service information.

The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).