DeutschShown in its original language — a full translation is planned for a future version.
Grafana: Mehrere Schwachstellen
view advisory published 2026-05-14
Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33381US | high8.1 | — | ||
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose acces… | ||||
| CVE-2026-33380US | medium6.5 | — | ||
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature tog… | ||||
| CVE-2026-33378US | — | — | ||
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or no… | ||||
| CVE-2026-33377US | — | — | ||
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. | ||||
| CVE-2026-33376US | — | — | ||
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired… | ||||
| CVE-2026-28383US | — | — | ||
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to t… | ||||
| CVE-2026-28380US | — | — | ||
Any Editor could delete any snapshot, even if they have no access to read or write them. | ||||
| CVE-2026-28379US | — | — | ||
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This resu… | ||||
| CVE-2026-28376US | — | — | ||
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions.… | ||||
| CVE-2026-28374US | — | — | ||
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-54243 vom 2026-08-13external
- Red Hat Security Advisory RHSA-2026:42852 vom 2026-07-21external
- Red Hat Security Advisory RHSA-2026:44622 vom 2026-07-23external
- Red Hat Security Advisory RHSA-2026:47149 vom 2026-07-28external
- Red Hat Security Advisory RHSA-2026:52946 vom 2026-08-10external
- Red Hat Security Advisory RHSA-2026:53530 vom 2026-08-11external
- Red Hat Security Advisory RHSA-2026:54178 vom 2026-08-12external
- Red Hat Security Advisory RHSA-2026:54243 vom 2026-08-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan