Bitnami package
grafana
pkg:bitnami/grafana
Vulnerabilities (112)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-28383 | Med | 6.5 | >= 6.7.0, < 11.6.14 | 11.6.14 | May 13, 2026 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service. | |
| CVE-2026-28380 | Med | 6.5 | >= 9.4.0, < 11.6.14 | 11.6.14 | May 13, 2026 | Any Editor could delete any snapshot, even if they have no access to read or write them. | |
| CVE-2026-28379 | Med | 6.5 | >= 8.2.0, < 11.6.14 | 11.6.14 | May 13, 2026 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server. | |
| CVE-2026-28376 | Med | 6.5 | >= 8.0.0, < 11.6.14 | 11.6.14 | May 13, 2026 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue. | |
| CVE-2026-28374 | Med | 4.3 | >= 8.5.0, < 11.6.14 | 11.6.14 | May 13, 2026 | Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. | |
| CVE-2026-21727 | Low | 3.3 | < 11.6.11 | 11.6.11 | Apr 15, 2026 | A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could r | |
| CVE-2025-12141 | Med | 6.5 | >= 8.0.0, < 12.3.1 | 12.3.1 | Apr 15, 2026 | In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Edito | |
| CVE-2026-28375 | Med | 6.5 | >= 8.1.0, < 11.6.14 | 11.6.14 | Mar 27, 2026 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. | |
| CVE-2026-27880 | Hig | 7.5 | >= 12.1.0, < 12.1.10 | 12.1.10 | Mar 27, 2026 | The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. | |
| CVE-2026-27879 | Med | 6.5 | >= 8.0.0, < 11.6.14 | 11.6.14 | Mar 27, 2026 | A resample query can be used to trigger out-of-memory crashes in Grafana. | |
| CVE-2026-27877 | Med | 6.5 | >= 9.3.0, < 11.6.14 | 11.6.14 | Mar 27, 2026 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as pos | |
| CVE-2026-27876 | Cri | 9.1 | >= 11.6.0, < 11.6.14 | 11.6.14 | Mar 27, 2026 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only inst | |
| CVE-2026-33375 | Med | 6.5 | >= 11.6.0, < 11.6.14 | 11.6.14 | Mar 26, 2026 | The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. | |
| CVE-2026-21724 | Med | 5.4 | >= 11.6.9, < 11.6.14 | 11.6.14 | Mar 26, 2026 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. | |
| CVE-2026-21725 | Low | 2.6 | >= 11.0.0, < 12.4.1 | 12.4.1 | Feb 25, 2026 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior | |
| CVE-2026-21722 | Med | 5.3 | >= 9.3.0, < 11.6.10 | 11.6.10 | Feb 12, 2026 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n | |
| CVE-2025-41117 | Med | 6.8 | >= 12.2.0, < 12.2.4 | 12.2.4 | Feb 12, 2026 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeg | |
| CVE-2026-21721 | Hig | 8.1 | >= 10.2.0, < 11.6.9 | 11.6.9 | Jan 27, 2026 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑int | |
| CVE-2026-21720 | Hig | 7.5 | >= 3.0.0, < 11.6.9 | 11.6.9 | Jan 27, 2026 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an un | |
| CVE-2025-41115 | Cri | 10.0 | >= 12.0.0, < 12.2.1 | 12.2.1 | Nov 21, 2025 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vuln |
- affected >= 6.7.0, < 11.6.14fixed 11.6.14
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.
- affected >= 9.4.0, < 11.6.14fixed 11.6.14
Any Editor could delete any snapshot, even if they have no access to read or write them.
- affected >= 8.2.0, < 11.6.14fixed 11.6.14
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.
- affected >= 8.0.0, < 11.6.14fixed 11.6.14
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
- affected >= 8.5.0, < 11.6.14fixed 11.6.14
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
- affected < 11.6.11fixed 11.6.11
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could r
- affected >= 8.0.0, < 12.3.1fixed 12.3.1
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Edito
- affected >= 8.1.0, < 11.6.14fixed 11.6.14
A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
- affected >= 12.1.0, < 12.1.10fixed 12.1.10
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
- affected >= 8.0.0, < 11.6.14fixed 11.6.14
A resample query can be used to trigger out-of-memory crashes in Grafana.
- affected >= 9.3.0, < 11.6.14fixed 11.6.14
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as pos
- affected >= 11.6.0, < 11.6.14fixed 11.6.14
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only inst
- affected >= 11.6.0, < 11.6.14fixed 11.6.14
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.
- affected >= 11.6.9, < 11.6.14fixed 11.6.14
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
- affected >= 11.0.0, < 12.4.1fixed 12.4.1
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior
- affected >= 9.3.0, < 11.6.10fixed 11.6.10
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n
- affected >= 12.2.0, < 12.2.4fixed 12.2.4
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeg
- affected >= 10.2.0, < 11.6.9fixed 11.6.9
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑int
- affected >= 3.0.0, < 11.6.9fixed 11.6.9
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an un
- affected >= 12.0.0, < 12.2.1fixed 12.2.1
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vuln
Page 2 of 6