Grafana Spoofing originalUrl of snapshots

Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

A resample query can be used to trigger out-of-memory crashes in Grafana.

Grafana: Pre-authentication denial of service in the public dashboard query handler

When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

Grafana public dashboards disclose all direct mode datasources

Grafana User enumeration via forget password

XSS vulnerability allowing arbitrary JavaScript execution

Email Validation Bypass And Preventing Sign Up From Email's Owner

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.

Grafana Email addresses and usernames can not be trusted

Any Editor could delete any snapshot, even if they have no access to read or write them.

ELSA-2026-54184: grafana security update (IMPORTANT)

ELSA-2026-10226: grafana security update (IMPORTANT)

ELSA-2026-10223: grafana security update (IMPORTANT)

ELSA-2025-7894: grafana security update (IMPORTANT)

ELSA-2025-7893: grafana security update (IMPORTANT)

ELSA-2025-7892: grafana security update (IMPORTANT)

ELSA-2023-6972: grafana security and enhancement update (MODERATE)

ELSA-2023-4030: grafana security update (CRITICAL)