Description Summary:
A vulnerability in Grafana IRM allows authenticated users to perform unauthorized actions, potentially impacting system integrity and availability.

Executive Summary:
Grafana IRM versions 1.0.0 through 1.164.0 are affected by a high-severity vulnerability that permits authenticated users to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9765

Affected Software: Grafana Grafana IRM

Affected Versions: 1.0.0 through 1.164.0

Vulnerability: This vulnerability involves an improper authorization flaw, which allows an authenticated attacker with low privileges to perform unauthorized modifications or disrupt service availability within the platform.

Business Impact

The exploitation of this vulnerability could lead to significant unauthorized changes to incident response configurations or service disruptions, directly impacting operational continuity. With a CVSS score of 7.1, the risk is categorized as High because it allows an attacker to manipulate core system functions despite requiring authenticated access. Failure to address this flaw may result in the corruption of critical incident data or unauthorized access to sensitive workflow parameters.

Remediation Plan

Immediate Action: Update Grafana IRM to the latest vendor-supplied patch version as detailed in the official security advisory.

Proactive Monitoring: Review audit logs for suspicious activity involving user-initiated configuration changes or unexpected spikes in service resource consumption.

Compensating Controls: Implement strict access control lists and principle of least privilege policies to limit the potential impact of an authenticated user session being compromised.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization issue that requires the attacker to have established a valid user session within the environment.

Analyst Recommendation

Given the potential for unauthorized system modifications, administrators should prioritize applying the security updates provided by Grafana. Ensure that all users maintain strong, unique credentials to mitigate the risk of account compromise, which is a prerequisite for exploiting this vulnerability.

Description Summary:
A vulnerability in the Grafana OSS geomap panel's XYZ tile layer involves an improper ordering of sanitization and interpolation, potentially leading to security bypasses.

Executive Summary:
An improper sanitization-then-interpolation bug in the Grafana OSS geomap panel presents a high-severity risk to system integrity and security.

Vulnerability Details

CVE-ID: CVE-2026-9029

Affected Software: Grafana Grafana OSS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs within the geomap panel component due to an ordering error where input is interpolated before being properly sanitized. This logic flaw potentially allows for the execution of malicious input within the application context.

Business Impact

The CVSS score of 7.3 underscores the potential for this vulnerability to be used as a vector for unauthorized operations. By exploiting this sanitization flaw, an attacker could potentially execute malicious payloads, resulting in unauthorized data access or disruption of Grafana's visualization and monitoring capabilities.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Grafana to remediate the geomap panel component.

Proactive Monitoring: Monitor Grafana dashboard usage and log files for suspicious input patterns or unexpected behavior within the geomap panels.

Compensating Controls: Restrict access to Grafana instances to trusted network segments and utilize Content Security Policy (CSP) headers to mitigate potential script execution risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Grafana is a critical component of many monitoring infrastructures; therefore, maintaining the integrity of its panels is essential. Administrators should treat this high-severity update with urgency and verify that all Grafana instances are updated to the patched version to prevent potential exploitation.

Description Summary:
The Grafana Loki datasource plugin is vulnerable to a path traversal flaw within its callResource handler, potentially allowing unauthorized file access.

Executive Summary:
A high-severity path traversal vulnerability in the Grafana Loki datasource plugin could allow unauthorized actors to read arbitrary files from the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-42129

Affected Software: Grafana Loki Datasource Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a path traversal vulnerability located in the callResource handler of the Loki plugin. Depending on the plugin configuration, this flaw may be reachable by authenticated users, potentially leading to unauthorized information disclosure.

Business Impact

The ability to perform path traversal poses a significant risk to data confidentiality, as attackers could potentially read sensitive configuration files, credentials, or system data. With a CVSS score of 7.7, this vulnerability is categorized as High, reflecting the potential for significant impact on system integrity and the exposure of sensitive organizational data.

Remediation Plan

Immediate Action: Identify and apply the security patch provided by Grafana to the affected Loki datasource plugin version.

Proactive Monitoring: Review web server and application logs for suspicious directory traversal patterns, such as sequences like "../" in requests directed toward the plugin endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block path traversal attempts and directory traversal payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, immediate action is required to secure affected Grafana instances. Administrators should verify the current plugin version against the vendor's security advisory and prioritize patching to prevent potential unauthorized access to sensitive system resources.

Description Summary:
An unauthenticated memory exhaustion vulnerability exists in the Grafana Enterprise public dashboard query endpoint due to missing request body size validation.

Executive Summary:
Grafana Enterprise is vulnerable to a remote denial-of-service attack that allows unauthenticated attackers to trigger excessive memory allocation.

Vulnerability Details

CVE-ID: CVE-2026-42127

Affected Software: Grafana Grafana Enterprise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an improper input validation flaw affecting the public dashboard query endpoint. An unauthenticated attacker can send maliciously large JSON payloads to force the application to consume excessive system memory, leading to service disruption.

Business Impact

Successful exploitation of this vulnerability results in service downtime, potentially rendering dashboards and critical data visualizations inaccessible to users. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to operational continuity, especially for organizations that rely on Grafana for real-time monitoring and incident response.

Remediation Plan

Immediate Action: Update to the latest version of Grafana Enterprise as soon as a patch is released by the vendor.

Proactive Monitoring: Monitor server memory utilization metrics and investigate sudden spikes in request payloads targeting the dashboard query endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to enforce strict request body size limits on incoming traffic to the Grafana dashboard endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitation by unauthenticated remote attackers, this vulnerability represents a significant risk to system availability. Administrators should prioritize identifying vulnerable instances and apply official vendor patches immediately upon availability to prevent potential denial-of-service attacks.

Description Summary:
Several Grafana OSS API endpoints fail to limit the size of request bodies before processing, leading to potential resource exhaustion and denial-of-service.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in Grafana OSS allows attackers to trigger denial-of-service conditions by sending oversized request bodies to vulnerable API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-33382

Affected Software: Grafana OSS

Affected Versions: 11.6.0-11.6.14, 12.2.0-12.2.8, 12.3.0-12.3.6, 12.4.0-12.4.3, 13.0.0-13.0.1

Vulnerability: The vulnerability is a classic CWE-400 (Uncontrolled Resource Consumption). By sending excessively large request bodies to specific API endpoints—some of which do not require authentication—an attacker can force the server to consume excessive memory or CPU, resulting in a denial-of-service (DoS) state.

Business Impact

The impact of this vulnerability is primarily focused on availability. Successful exploitation can render the Grafana dashboard and its associated alerting or monitoring services inaccessible. With a CVSS score of 7.5, the risk to business operations is significant, particularly for organizations that rely on Grafana for real-time observability and incident response.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Grafana OSS as specified in the vendor security advisory.

Proactive Monitoring: Monitor server metrics such as memory usage, CPU load, and API response times for sudden spikes indicative of an exhaustion attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or reverse proxy to enforce request body size limits before the traffic reaches the Grafana service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, making it a prime candidate for opportunistic DoS attacks.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency, as the unauthenticated nature of the affected endpoints makes it easily exploitable from the public internet. Patching the affected Grafana instances is the most effective way to prevent resource exhaustion and ensure the continued availability of your monitoring infrastructure.

Description Summary:
The Grafana Snowflake Datasource allows authenticated users to read or write arbitrary files between the local Grafana server and the Snowflake host.

Executive Summary:
A critical vulnerability in the Grafana Snowflake Datasource allows an authenticated user to perform unauthorized file system operations between the server and the database host.

Vulnerability Details

CVE-ID: CVE-2026-28381

Affected Software: Grafana Snowflake Datasource

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists due to improper validation of commands within the Snowflake datasource. Any authenticated user with access to the data source can execute GET/PUT commands to manipulate files on the underlying infrastructure.

Business Impact

The CVSS score of 9.6 reflects the severe potential for unauthorized data access and system modification. An attacker could leverage this vulnerability to gain sensitive configuration files, overwrite critical system binaries, or pivot further into the network, leading to a complete breach of the Grafana environment.

Remediation Plan

Immediate Action: Update the Grafana Snowflake Datasource plugin to the latest version released by the vendor to remediate the insecure command execution flaw.

Proactive Monitoring: Review Grafana access logs and audit trails to identify any suspicious or unauthorized usage of the Snowflake datasource by existing user accounts.

Compensating Controls: Restrict permissions for the Snowflake datasource to only necessary users and utilize network-level segmentation to limit the impact of a compromised Grafana server.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to data integrity and system security. Organizations should immediately update the affected plugin and audit current user permissions to ensure that only authorized personnel have access to sensitive data sources.

Description Summary:
The OpenFeature toggle evaluation endpoint in Grafana performs unbounded memory reads, leading to potential denial of service through out-of-memory crashes.

Executive Summary:
An unauthenticated remote denial of service vulnerability in Grafana allows attackers to crash instances by sending specifically crafted requests to the feature toggle evaluation endpoint.

Vulnerability Details

CVE-ID: CVE-2026-27880

Affected Software: Grafana Grafana

Affected Versions: v12.1.0 up to (excluding) v12.1.10, v12.2.0 up to (excluding) v12.2.8, v12.3.0 up to (excluding) v12.3.6, v12.4.0 up to (excluding) v12.4.2

Vulnerability: This is a resource exhaustion vulnerability occurring within the OpenFeature feature toggle evaluation endpoint. The application fails to properly constrain the size of input values before reading them into memory, allowing unauthenticated attackers to trigger an out-of-memory condition.

Business Impact

Successful exploitation of this vulnerability results in the immediate crash of the affected Grafana service, causing significant operational downtime. With a CVSS score of 7.5, this high-severity flaw poses a risk to business continuity, as it allows external actors to disrupt critical observability and monitoring dashboards without requiring any prior authentication.

Remediation Plan

Immediate Action: Update all affected Grafana instances to the patched versions (v12.1.10, v12.2.8, v12.3.6, or v12.4.2) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs and infrastructure metrics for frequent service restarts or memory spikes associated with requests to the OpenFeature endpoint.

Compensating Controls: Deploy a Web Application Firewall to inspect incoming requests and block abnormally large payloads directed at the feature toggle evaluation endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and the trivial nature of triggering an out-of-memory state.

Analyst Recommendation

Given the high impact on service availability and the ease of exploitation, organizations should prioritize patching their Grafana deployments immediately. Administrators must verify their current version against the affected ranges and apply the provided security updates to prevent potential denial of service attacks against their monitoring infrastructure.

Description Summary:
A chained attack involving SQL Expressions and a Grafana Enterprise plugin enables remote arbitrary code execution (RCE) when the sqlExpressions feature toggle is active.

Executive Summary:
Grafana instances with the sqlExpressions feature enabled are at critical risk of Remote Code Execution (RCE) through a chained vulnerability in Enterprise plugins.

Vulnerability Details

CVE-ID: CVE-2026-27876

Affected Software: Grafana (OSS and Enterprise)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a chained vulnerability where the "sqlExpressions" feature toggle in Grafana OSS interacts with a Grafana Enterprise plugin to allow Remote Code Execution. An attacker can exploit this chain to execute arbitrary code on the host system.

Business Impact

The CVSS score of 9.1 indicates a critical risk to the organization. Successful exploitation allows an attacker to gain full control over the Grafana server, potentially leading to lateral movement within the network, data exfiltration, and complete compromise of the monitoring infrastructure. This could result in prolonged service outages and significant security remediation costs.

Remediation Plan

Immediate Action: Update Grafana and all Enterprise plugins to the latest versions immediately. If patching is not possible, disable the sqlExpressions feature toggle in the Grafana configuration.

Proactive Monitoring: Monitor system logs for unauthorized shell execution or unexpected network connections originating from the Grafana server.

Compensating Controls: Restrict access to the Grafana web interface to authorized internal users only and ensure the service is running with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of the chain may limit widespread exploitation, but the RCE impact makes it a high-priority target.

Analyst Recommendation

Due to the potential for Remote Code Execution, this vulnerability must be addressed with the highest urgency. Administrators should prioritize upgrading their Grafana environment and verifying that the sqlExpressions feature is only enabled if absolutely necessary and properly secured.

Description Summary:
Grafana Tempo and Enterprise Traces are susceptible to a denial of service vulnerability where queries with excessively large limits trigger memory exhaustion, leading to service instability or crashes.

Executive Summary:
An unauthenticated remote attacker can cause a denial of service in Grafana Tempo and Grafana Enterprise Traces by submitting queries with large limits, which triggers excessive memory allocation.

Vulnerability Details

CVE-ID: CVE-2026-21728

Affected Software: Grafana Tempo and Grafana Enterprise Traces (GET)

Affected Versions: Grafana Tempo: 1.3.0 through 2.8.3, 2.9.0 through 2.9.1, 2.10.0 through 2.10.1; Grafana Enterprise Traces (GET): 1.0.0 through 2.8.7

Vulnerability: The vulnerability is an improper resource management flaw where the application fails to adequately constrain memory allocation for incoming search queries. This allows an unauthenticated attacker to exhaust system memory, potentially forcing a service restart or crashing the node.

Business Impact

The exploitation of this vulnerability directly impacts service availability, which can disrupt observability pipelines and monitoring operations. Given the CVSS score of 7.5, this is classified as a High severity issue because it allows for an unauthenticated attacker to degrade infrastructure performance or cause complete service outages, leading to potential operational downtime.

Remediation Plan

Immediate Action: Update Grafana Tempo to versions 2.8.4, 2.9.2, or 2.10.2 as appropriate for your deployment. If immediate patching is not feasible, apply the mitigation by setting the max_result_limit parameter in the search configuration to 262144.

Proactive Monitoring: Monitor system memory usage and service logs for spikes in memory consumption or unexpected service restarts that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway to filter incoming requests and limit query parameters that could trigger excessive resource consumption.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable because it does not require authentication to submit search queries.

Analyst Recommendation

The vulnerability poses a significant risk to the stability of Grafana Tempo environments. Organizations should prioritize updating to the fixed versions listed in this advisory. If an immediate update is not possible, implementing the recommended configuration change to limit search results is a critical step to prevent service disruption from malicious or accidental query load.

Description Summary:
The Grafana dashboard permissions API fails to validate scopes, allowing authenticated users with partial management rights to escalate privileges and modify permissions on unauthorized dashboards.

Executive Summary:
A critical privilege escalation vulnerability in Grafana allows authenticated users to improperly modify dashboard permissions across the organization.

Vulnerability Details

CVE-ID: CVE-2026-21721

Affected Software: Grafana

Affected Versions: Grafana 12.3.0-12.3.1 (excl), 12.2.0-12.2.3 (excl), 12.1.0-12.1.5 (excl), 12.0.0-12.0.8 (excl), 10.2.0-11.6.9 (excl)

Vulnerability: This is an improper authorization vulnerability where the dashboard permissions API fails to verify the target dashboard scope. Any authenticated user with existing permission management rights on a single dashboard can abuse this flaw to read and modify permissions on any other dashboard within the instance.

Business Impact

The ability for a standard user to manipulate dashboard access controls poses a severe risk to data confidentiality and integrity. An attacker could grant themselves unauthorized access to sensitive dashboards or revoke access for administrators, leading to potential data exposure or service disruption. With a CVSS score of 8.1, this represents a high-severity risk that demands immediate attention to maintain the security posture of the analytics environment.

Remediation Plan

Immediate Action: Update all affected Grafana and Grafana Enterprise instances to the latest patched versions provided in the vendor security advisory.

Proactive Monitoring: Review audit logs for unusual permission changes or access patterns involving dashboard management API endpoints.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies and limit users with dashboard permission management privileges to the absolute minimum necessary.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository is available on GitHub.

Analyst Notes: As of January 28, 2026, there is no public information indicating active exploitation in the wild, though a public proof-of-concept exists on GitHub. The vulnerability leverages a flaw in scope validation, making it an attractive target for internal lateral movement.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, organizations must prioritize patching their Grafana environments. Failure to address this vulnerability allows malicious insiders or compromised user accounts to bypass intended authorization boundaries, creating a significant risk to internal data security.

Description Summary:
An unauthenticated denial of service vulnerability in Grafana allows remote attackers to exhaust system memory and crash the service by sending sustained requests for uncached avatar hashes.

Executive Summary:
A memory exhaustion vulnerability in Grafana and Grafana Enterprise allows unauthenticated remote attackers to trigger a service crash through sustained traffic.

Vulnerability Details

CVE-ID: CVE-2026-21720

Affected Software: Grafana and Grafana Enterprise

Affected Versions: 3.0.0 up to (excluding) 11.6.9, 12.0.8, and 12.1.5

Vulnerability: The application incorrectly handles goroutines during Gravatar image refreshes, where requests that time out continue to block indefinitely, eventually leading to uncontrolled resource consumption by an unauthenticated attacker.

Business Impact

Successful exploitation of this vulnerability results in a denial of service, rendering Grafana instances unavailable to legitimate users. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, potentially causing system crashes that require manual intervention to restore service.

Remediation Plan

Immediate Action: Upgrade Grafana and Grafana Enterprise to version 11.6.9, 12.0.8, 12.1.5, or later, as provided in the official vendor security advisory.

Proactive Monitoring: Monitor server memory utilization and identify spikes in requests to the /avatar/ endpoint, which may indicate an ongoing exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) to rate-limit requests to the /avatar/ path, effectively mitigating the ability of an attacker to send the sustained traffic required to trigger the memory exhaustion.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the provided data.

Analyst Notes: As of January 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it is easily automatable and requires no authentication to trigger, making it an attractive target for service disruption.

Analyst Recommendation

This vulnerability presents a clear risk to availability and should be prioritized for remediation. Administrators must verify their current Grafana version and apply the appropriate security updates immediately to prevent potential service instability caused by memory exhaustion.

Description Summary:
Grafana MCP Server is vulnerable to a confused-deputy attack, allowing unauthenticated remote attackers to exfiltrate service-account tokens via a crafted X-Grafana-URL header.

Executive Summary:
A high-severity confused-deputy flaw in Grafana MCP Server allows unauthenticated attackers to exfiltrate sensitive service-account tokens, risking full compromise of integrated systems.

Vulnerability Details

CVE-ID: CVE-2026-15583

Affected Software: Grafana Grafana MCP Server

Affected Versions: 0.0.0 through 0.17.1

Vulnerability: This is a confused-deputy vulnerability that occurs when the server processes a crafted X-Grafana-URL request header. The vulnerability is remotely exploitable by unauthenticated attackers, leading to the unauthorized disclosure of environment-configured tokens.

Business Impact

The exfiltration of a Grafana service-account token grants the attacker the same permissions as the service account, which may include administrative access to Grafana and connected data sources. With a CVSS score of 8.6, this flaw poses a severe risk of lateral movement and large-scale data compromise within the infrastructure.

Remediation Plan

Immediate Action: Upgrade Grafana MCP Server to the latest patched version provided by the vendor to prevent the processing of malicious URL headers.

Proactive Monitoring: Monitor network traffic and server logs for requests containing suspicious or anomalous X-Grafana-URL headers.

Compensating Controls: Implement network-level egress filtering to restrict the server from communicating with unauthorized or untrusted external URLs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly concerning because it allows for the theft of high-privilege credentials without requiring prior authentication.

Analyst Recommendation

Given the potential for complete service-account compromise, immediate remediation is required. Security teams should identify all instances of the affected Grafana MCP Server and apply the vendor-provided updates to mitigate this vulnerability.

Description Summary:
Pyroscope is vulnerable to an information disclosure flaw where the secret_key configuration can be extracted from the API when Tencent Cloud Object Storage is used as a backend.

Executive Summary:
A critical information disclosure vulnerability in Pyroscope allows attackers to extract sensitive secret keys, potentially leading to unauthorized access to storage backends.

Vulnerability Details

CVE-ID: CVE-2025-41118

Affected Software: Pyroscope

Affected Versions: 1.15.2, 1.16.1, and 1.17.0 (Fixed versions)

Vulnerability: When configured with Tencent Cloud Object Storage (COS), the Pyroscope API fails to protect the secret_key configuration value. An attacker with direct access to the API can extract this key, compromising the security of the storage backend.

Business Impact

With a CVSS score of 9.1, this vulnerability presents a significant risk to data confidentiality. Exposure of storage secret keys grants an attacker unauthorized access to potentially sensitive profiling data stored in the cloud, leading to severe privacy and compliance breaches.

Remediation Plan

Immediate Action: Upgrade Pyroscope to version 1.15.2, 1.16.1, 1.17.0, or higher to resolve the key exposure issue.

Proactive Monitoring: Monitor API access logs for unauthorized requests and rotate any secret_key values that may have been exposed during the vulnerable period.

Compensating Controls: Restrict access to the Pyroscope API to trusted internal networks or VPNs to prevent direct exposure to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. The risk is high, however, given the potential impact on cloud storage security.

Analyst Recommendation

Upgrade to the specified fixed versions immediately to remediate the vulnerability. Furthermore, organizations should treat any exposed storage keys as compromised, rotate them immediately, and ensure the Pyroscope instance is not exposed to the public internet.

Description Summary:
A vulnerability in Grafana Enterprise SCIM provisioning allows a compromised client to override internal user IDs via malicious numeric external IDs, leading to privilege escalation or impersonation.

Executive Summary:
A critical vulnerability in Grafana Enterprise versions 12.x allows unauthenticated attackers to perform privilege escalation or impersonate users if specific SCIM configurations are active.

Vulnerability Details

CVE-ID: CVE-2025-41115

Affected Software: Grafana Enterprise

Affected Versions: 12.0.0 up to (excluding) 12.2.1

Vulnerability: The flaw resides in the user identity handling logic during SCIM provisioning. It permits an unauthenticated attacker, acting as a compromised SCIM client, to manipulate numeric external identifiers to override internal system accounts.

Business Impact

The potential impact of this vulnerability is total system compromise, as an attacker can gain administrative privileges or impersonate any user within the Grafana environment. Given the CVSS score of 10.0, this represents an extreme risk to data confidentiality, integrity, and availability, potentially resulting in unauthorized access to sensitive organizational dashboards and data sources.

Remediation Plan

Immediate Action: Upgrade to Grafana Enterprise version 12.2.2 or the latest available patch version as specified by the vendor.

Proactive Monitoring: Monitor SCIM provisioning logs for unusual numeric externalId values or unexpected modifications to administrative user accounts.

Compensating Controls: If immediate patching is not feasible, temporarily disable the SCIM provisioning feature by setting enableSCIM to false and user_sync_enabled to false in the configuration file.

Exploitation Status

Public Exploit Available: Yes, multiple public proof-of-concept repositories are available on GitHub.

Analyst Notes: As of Nov 21, 2025, there is no confirmed active exploitation in the wild. However, the presence of multiple public proof-of-concept repositories significantly lowers the barrier to entry for attackers, making the exploitation risk high. The vulnerability is inherently dangerous because it allows for direct manipulation of the identity provider database.

Analyst Recommendation

This vulnerability presents a critical threat to organizational security due to the potential for full identity takeover. Administrators must prioritize applying the provided patches immediately. If patching cannot be performed during the current maintenance window, disabling the SCIM integration is the only effective way to neutralize this risk until the environment is updated.

Description Summary:
Grafana Image Renderer contains an arbitrary file write vulnerability in the /render/csv endpoint, allowing authenticated attackers to achieve remote code execution via file injection.

Executive Summary:
The Grafana Image Renderer plugin is vulnerable to remote code execution due to improper validation of the filePath parameter, posing a critical risk to affected systems.

Vulnerability Details

CVE-ID: CVE-2025-11539

Affected Software: Grafana grafana-image-renderer

Affected Versions: 1.0.0 through 4.0.16

Vulnerability: This vulnerability stems from improper control of code generation (CWE-94) in the /render/csv endpoint. An authenticated attacker who knows the authToken can supply a malicious filePath to write a shared object to an arbitrary location, which is subsequently executed by the Chromium process.

Business Impact

The ability to achieve remote code execution provides an attacker with full control over the underlying system, leading to total compromise of data confidentiality, integrity, and availability. With a CVSS score of 9.9, this vulnerability represents a critical threat that could lead to unauthorized data exfiltration, lateral movement within the network, or complete service disruption.

Remediation Plan

Immediate Action: Update the grafana-image-renderer plugin to version 4.0.17 or later as provided in the vendor security advisory.

Proactive Monitoring: Monitor server access logs for unusual requests directed at the /render/csv endpoint, particularly those containing suspicious file path patterns.

Compensating Controls: Ensure the default authToken is rotated immediately and restrict network access to the image renderer endpoint to authorized internal segments only, effectively limiting the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly critical, the requirement for an authenticated token or knowledge of the default token provides a limited barrier to entry that should be strengthened by immediate configuration changes.

Analyst Recommendation

Given the critical CVSS severity of 9.9 and the potential for complete system takeover, organizations must prioritize patching the Grafana Image Renderer plugin immediately. Administrators should verify that the default authToken has been changed and restrict access to rendering services to mitigate the risk while the update is deployed.

Description Summary:
Grafana is vulnerable to a directory traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server filesystem via the plugin API endpoint.

Executive Summary:
This critical path traversal vulnerability in Grafana is currently being actively exploited in the wild, allowing unauthenticated attackers to read sensitive files from the server.

Vulnerability Details

CVE-ID: CVE-2021-43798

Affected Software: Grafana Labs Grafana

Affected Versions: Grafana versions 8.0.0-beta1 through 8.0.6, 8.1.0 through 8.1.7, 8.2.0 through 8.2.6, and 8.3.0 are vulnerable.

Vulnerability: The application is susceptible to a directory traversal vulnerability (CWE-22) residing in the plugin API endpoint. An unauthenticated attacker can craft a malicious URL request to access files outside of the intended web root, facilitating unauthorized local file inclusion and data exfiltration.

Business Impact

The CVSS score of 9.5 reflects the extreme severity of this flaw, as it allows complete unauthorized access to sensitive configuration files, credentials, or system data stored on the host. This exposure can lead to full system compromise, lateral movement within the network, and severe reputational damage. Given the ease of exploitation, the risk to business continuity is critical.

Remediation Plan

Immediate Action: Upgrade to Grafana version 8.0.7, 8.1.8, 8.2.7, or 8.3.1 immediately to patch the vulnerability.

Proactive Monitoring: Monitor web server logs for requests containing suspicious directory traversal patterns, such as sequences of double dots and slashes directed toward the /public/plugins/ endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block path traversal attempts and filter requests containing suspicious plugin path parameters as a temporary measure until updates are applied.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of October 9, 2025. The flaw is highly exploitable, requiring no authentication, and multiple public proof-of-concept exploits are widely available, necessitating immediate patching.

Analyst Recommendation

Due to the confirmed active exploitation and the critical nature of this path traversal vulnerability, immediate action is required. Organizations must prioritize upgrading their Grafana instances to the specified patched versions. Failure to remediate this vulnerability exposes the environment to significant risk of unauthorized data access and potential full system takeover.