Grafana Labs Security

Team preferences RBAC bypass through the set-home-dash endpoint

Privilege escalation through folder move in the folders API

Path traversal in Git Sync delete and move jobs

Memory exhaustion denial of service in SQL Expressions

Git Sync connections send credentials to unvalidated server URLs

Folder permission bypass in the Git Sync repository files API

Folder authorization bypass in the Git Sync provisioning files API

Cross-instance user impersonation through image renderer JWTs

Authorization bypass in the Git Sync provisioning jobs API

SSO settings authorization bypass

Server-side expression parser denial of service

Azure Monitor access token disclosure via SSRF

Alerting contact point authorization bypass via schema downgrade

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Unbounded memory allocation in the Prometheus rule conversion API

Git Sync memory exhaustion via a malicious Git server

Git Sync connection configuration can be modified with read-only access

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Arbitrary file read via the convert_playwright_script prompt in mcp-k6

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Alert rules in restricted folders disclosed via the alert rules list API

Paused shared dashboard access tokens still expose data source configuration

Library panel can be moved into a folder without library panel create permission

Geomap MapLibre XSS

Grafana Plugin Extraction Zip Slip

SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Session takeover via Auth Proxy cache key collision

SAML assertion replay via skipped InResponseTo validation

Grafana Alloy: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

clickhouse-datasource silently drops TLS over PDC

Broken access control in dashboard snapshots

Grafana OSS: Stored XSS via external Alertmanager generatorURL

Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request)

DoS Vulnerability in Templates Test endpoint

Loki detected_fields query limits results in unbounded memory allocation

Grafana MCP server-side request forgery via X-Grafana-URL header

Operator - Namespaced User Path Traversal

Stored XSS in the Geomap panel tile-layer attribution

Pre-authentication denial of service in the public dashboard query handler

Pre-authentication denial of service in the OAuth login route

Path traversal in the Tempo and Loki data source plugins

Path traversal in the Loki data source leads to internal information disclosure

Grafana denial of service via oversized request bodies (web.Bind)

Viewer-triggered race condition in Grafana Live leads to complete server crash

Users can generate Service Account tokens after permissions removal

SQL Expressions Read File From Disk

IDOR in Annotations API allows unprivileged users to DELETE annotation

Grafana plugin resources can lead to unbounded memory allocation

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Auth Proxy IPv6 whitelist bypass