Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Grafana Enterprise, Grafana OSS 12.4.13, 13.0.11 and 2 more versions Clear all filters
TI-2026-71901 CVE-2026-33374 · GHSA-5mj5-pfmr-wxjp

Unbounded memory allocation in Grafana Prometheus rule conversion API

Priority LOW 29

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-13 Partial fix · 12.4.13, 13.0.11 +2 CWE-400
TI-2026-71895 CVE-2026-15577 · GHSA-pm7c-5ghp-r9fq

Git Sync connections can be modified with read-only access in Grafana

Priority LOW 28

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-13 Partial fix · 12.4.13, 13.0.11 +2 CWE-863
TI-2026-71933 CVE-2026-93294 · GHSA-5wf9-m99g-f6xj

Azure Monitor data source proxy lets users call arbitrary Azure APIs

Priority LOW 28

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy).

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00267 Published 2026-10-13 Partial fix · 12.4.13, 13.0.11 +2 CWE-1220