Is Grafana 9.0.9 affected?

Vulnerabilities affecting 9.0.9

• 9.1
  CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… fixed in 11.6.0
• 8.3
  CVE-2022-41912 SAML privilege escalation fixed in 9.2.0
• 7.6
  CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… fixed in 10.4.18
• 7.5
  CVE-2026-42127 The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON p…
• 7.5
  CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. fixed in 12.1.0
• 7.5
  CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops… fixed in 11.6.9
• 7.4
  CVE-2026-33376 When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /1… fixed in 11.6.14
• 7.1
  CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and for… fixed in 11.0.0
• 7.1
  CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege. fixed in 11.6.14
• 7.1
  CVE-2022-23498 Use of Cache Containing Sensitive Information fixed in 9.2.10
• 6.8
  CVE-2022-39201 Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins fixed in 9.1.0
• 6.7
  CVE-2023-4822 Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in… fixed in 9.4.16
• 6.7
  CVE-2022-39324 Spoofing originalUrl of snapshots fixed in 9.2.8
• 6.5
  CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. fixed in 11.6.14
• 6.5
  CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-… fixed in 11.6.14
• 6.5
  CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as th… fixed in 11.6.14
• 6.5
  CVE-2026-28376 The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated… fixed in 11.6.14
• 6.5
  CVE-2026-28379 A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete s… fixed in 11.6.14
• 6.5
  CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as p…
• 6.5
  CVE-2026-27877 When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We enco… fixed in 9.3.0
• 6.4
  CVE-2022-39306 Email addresses and usernames can not be trusted fixed in 9.2.4
• 6.1
  CVE-2022-31123 Plugin signature bypass fixed in 9.1.8
• 6.0
  CVE-2024-1442 A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data so… fixed in 9.5.7
• 5.3
  CVE-2022-39307 User enumeration via forget password fixed in 9.2.4
• 4.9
  CVE-2022-31130 Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins fixed in 9.1.8
• 4.3
  CVE-2026-28374 Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. fixed in 11.6.14
• 4.3
  CVE-2022-39229 Using email as a username can block other users from signing in fixed in 9.1.8
• 4.3
  CVE-2022-21673 Forward OAuth Identity Token can allow users to access some data sources
• 4.1
  CVE-2023-2183 Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible… fixed in 9.2.19
• 3.3
  CVE-2026-21727 A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be… fixed in 11.6.11

Newer releases