IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.5Mittel

CVE-2026-88858Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise Veröffentlicht: (vor 13 Tagen)

Beschreibung

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Schwachstellentyp (CWE): CWE-674CWE-20CWE-400

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Grafana Grafana Enterprise 7.4.0 – ≤ 11.6.16, 12.0.0 – ≤ 12.2.10, 12.3.0 – ≤ 12.3.11, 12.4.0 – ≤ 12.4.13, 13.0.0 – ≤ 13.0.11, 13.1.0 – ≤ 13.1.8, 13.2.0 – ≤ 13.2.4
Grafana Grafana OSS 7.4.0 – ≤ 11.6.16, 12.0.0 – ≤ 12.2.10, 12.3.0 – ≤ 12.3.11, 12.4.0 – ≤ 12.4.13, 13.0.0 – ≤ 13.0.11, 13.1.0 – ≤ 13.1.8, 13.2.0 – ≤ 13.2.4

Referenzen und Patches

Neue CVEs im selben Produkt — Grafana

8.5Hoch
CVE-2026-33379

Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13…

8.9Hoch
CVE-2026-103506

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

7.7Hoch
CVE-2026-88967

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Hoch
CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

6.5Mittel
CVE-2026-16491

CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of ever…