目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

Grafana 厂商漏洞列表 / CVE 中文分析 111

Grafana 厂商相关 111 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Grafana 是开源分析与可视化平台，广泛用于监控指标与日志数据。其历史漏洞多涉及未授权访问、越权操作及跨站脚本，部分版本曾存在远程代码执行风险。近期安全更新强化了身份验证机制与插件沙箱隔离，以应对供应链攻击。鉴于已收录 85 条 CVE，用户需及时升级并配置最小权限原则，确保数据看板与后端存储的安全隔离，防范敏感信息泄露。

上位製品 Grafana: grafana Grafana OSS Grafana Enterprise grafana/grafana grafana-image-renderer Grafana MCP Server Loki Tempo grafana-zabbix-plugin Grafana IRM Snowflake Datasource Enterprise Traces (GET) Grafana Operator Grafana Alerting Pyroscope Grafana Correlations grafana/grafana-enterprise grafana-infinity-datasource Alloy Agent Flow OnCall grafana-json-datasource grafana-csv-datasource worldmap-panel google-sheets-datasource synthetic-monitoring-agent agent
CVE IDタイトルCVSS深刻度公開日
CVE-2026-19516 CVE-2026-19516 CVE Record — Grafana MCP ServerCWE-918 9.1 Critical2026-08-11
CVE-2026-9765 CVE-2026-9765 CVE Record — Grafana IRM 7.1 High2026-07-24
CVE-2026-21723 CVE-2026-21723 Record — Grafana OSS 5.3 Medium2026-07-23
CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation — Loki 7.5 High2026-07-16
CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header — Grafana MCP Server 8.6 High2026-07-15
CVE-2026-8595 Stored XSS in the table panel (TableNG) — Grafana OSSCWE-79 6.8 Medium2026-07-10
CVE-2026-8609 Pre-authentication denial of service via the OAuth login route — Grafana OSSCWE-400 5.3 Medium2026-07-10
CVE-2026-33382 Denial of service via unbounded request body size — Grafana OSSCWE-400 7.5 High2026-07-10
CVE-2026-28378 Cross-Organization Public Dashboard Deletion via Missing Org Isolation — Grafana Enterprise 3.1 Low2026-07-07
CVE-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint — Grafana EnterpriseCWE-400 7.5 High2026-06-22
CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT — Snowflake Datasource 9.6 Critical2026-06-22
CVE-2026-9029 Stored XSS in the Geomap panel tile-layer attribution — Grafana OSSCWE-79 7.3 High2026-06-22
CVE-2026-10601 Path traversal in the Tempo and Loki data source plugins — Grafana OSSCWE-22 5.4 Medium2026-06-22
CVE-2026-42129 Path traversal in the Loki data source plugin — Grafana OSSCWE-22 7.7 High2026-06-22
CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage — Enterprise Traces (GET) 6.5 Medium2026-06-19
CVE-2026-11769 Operator - Namespaced User Path Traversal — Grafana Operator 6.4 Medium2026-06-13
CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation — Grafana OSS 4.3 Medium2026-05-13
CVE-2026-33378 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro — Grafana OSS 6.5 Medium2026-05-13
CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation — Grafana OSS 6.5 Medium2026-05-13
CVE-2026-33376 Auth Proxy IPv6 whitelist bypass — Grafana OSS 7.4 High2026-05-13
CVE-2026-33380 SQL Expressions Read File From Disk — Grafana OSS 6.3 Medium2026-05-13
CVE-2026-33381 Users can generate Service Account tokens after permissions removal — Grafana OSS 5.9 Medium2026-05-13
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots — Grafana OSS 6.5 Medium2026-05-13
CVE-2026-33377 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin — Grafana OSS 7.1 High2026-05-13
CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM — Grafana OSS 6.5 Medium2026-05-13
CVE-2026-28379 Viewer-triggered race condition in Grafana Live leads to complete server crash — Grafana OSS 6.5 Medium2026-05-13
CVE-2026-21728 Tempo query limit results in unbounded memory allocation — Tempo 7.5 High2026-04-24
CVE-2026-21726 Loki Path Traversal - CVE-2021-36156 Bypass — Loki 5.3 Medium2026-04-15
CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection — Pyroscope 9.1 Critical2026-04-15
CVE-2026-21727 Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record — Grafana Correlations 3.3 Low2026-04-15

本页汇总了 Grafana 厂商截至目前公开的全部 111 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。