Grafana Labs Security

Geomap MapLibre XSS

SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Session takeover via Auth Proxy cache key collision

SAML assertion replay via skipped InResponseTo validation

Grafana Alloy: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

clickhouse-datasource silently drops TLS over PDC

Broken access control in dashboard snapshots

Grafana OSS: Stored XSS via external Alertmanager generatorURL

Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request)

DoS Vulnerability in Templates Test endpoint

Loki detected_fields query limits results in unbounded memory allocation

Grafana MCP server-side request forgery via X-Grafana-URL header

Operator - Namespaced User Path Traversal

Stored XSS in the Geomap panel tile-layer attribution

Pre-authentication denial of service in the public dashboard query handler

Pre-authentication denial of service in the OAuth login route

Path traversal in the Tempo and Loki data source plugins

Path traversal in the Loki data source leads to internal information disclosure

Grafana denial of service via oversized request bodies (web.Bind)

Viewer-triggered race condition in Grafana Live leads to complete server crash

Users can generate Service Account tokens after permissions removal

SQL Expressions Read File From Disk

IDOR in Annotations API allows unprivileged users to DELETE annotation

Grafana plugin resources can lead to unbounded memory allocation

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Auth Proxy IPv6 whitelist bypass