Is Grafana 7.5.16 affected?

Vulnerabilities affecting 7.5.16

• 9.4
  CVE-2023-3128 Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authenticatio… fixed in 8.5.27
• 9.1
  CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… fixed in 11.6.0
• 8.3
  CVE-2022-41912 SAML privilege escalation fixed in 8.5.16
• 7.6
  CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… fixed in 10.4.18
• 7.5
  CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON p…
• 7.5
  CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. fixed in 12.1.0
• 7.5
  CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… fixed in 11.6.9
• 7.3
  CVE-2023-0594 Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnera… fixed in 8.5.21
• 7.3
  CVE-2022-31097 Stored XSS in Unified Alerting fixed in 8.3.10
• 7.1
  CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… fixed in 11.0.0
• 7.1
  CVE-2022-31107 Grafana account takeover via OAuth vulnerability fixed in 8.3.10
• 6.8
  CVE-2022-39201 Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins fixed in 8.5.14
• 6.7
  CVE-2022-39324 Spoofing originalUrl of snapshots fixed in 8.5.16
• 6.6
  CVE-2022-35957 Escalation from admin to server admin when auth proxy is used fixed in 8.5.13
• 6.5
  CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… fixed in 9.3.0
• 6.5
  CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana. fixed in 8.0.0
• 6.5
  CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana. fixed in 8.1.0
• 6.1
  CVE-2022-31123 Plugin signature bypass fixed in 8.5.14
• 5.3
  CVE-2022-39307 User enumeration via forget password fixed in 8.5.15
• 4.9
  CVE-2022-31130 Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins fixed in 8.5.14
• 4.3
  CVE-2022-39229 Using email as a username can block other users from signing in fixed in 8.5.14
• 4.3
  CVE-2022-21673 Forward OAuth Identity Token can allow users to access some data sources
• 3.3
  CVE-2026-21727 A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… fixed in 11.6.11

Newer releases