#grafana
4 articles
CVE-2026-63087: unauthenticated PluginAuthToken acquisition in Grafana OnCall (CVSS 9.8)
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install ...
CVE-2026-28381: Snowflake datasource GET/PUT commands enabling file read/write in Grafana (CVSS 9.6)
The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected...
CVE-2025-41118: Data handling vulnerability in Grafana Pyroscope
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent C...
CVE-2026-27876: Remote code execution in Grafana
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always ...