Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Grafana 11.6.14, 12.1.10 and 3 more versions Clear all filters
TI-2026-22223 CVE-2026-27879 · GHSA-4368-7mjc-5763

Query resampling can cause unbounded memory allocations

Priority LOW 29

A resample query can be used to trigger out-of-memory crashes in Grafana.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0039 Published 2026-03-27 Partial fix · 11.6.14, 12.1.10 +3 CWE-400
TI-2026-22220 CVE-2026-27876 · GHSA-736h-475m-xhjc

RCE on Grafana via sqlExpressions

Priority MEDIUM 45

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01963 Published 2026-03-27 Fixed in 11.6.14, 12.1.10 +3 CWE-94
TI-2026-22221 CVE-2026-27877 · GHSA-3q27-7qjq-p9c5

Public dashboards discloses all direct mode datasources

Priority LOW 33

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00314 Published 2026-03-27 Fixed in 11.6.14, 12.1.10 +4 CWE-312