products / grafana

Grafana

Grafana is an open-source observability platform for metrics, logs, and traces. A compromised instance exposes read access across the telemetry stack and often holds data-source credentials. NVD tracks it as grafana:grafana with semver-style version ranges.

api usage

Querying Grafana

product sluggrafana

version format10.0.0, 9.5.0, 8.3.0

bash

curl "https://api.attestd.io/v1/check?product=grafana&version=10.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Grafana 10.0.0 is affected by CVE-2023-3128 (Azure AD email-claim account takeover via a non-unique modifiable email). The response shows risk_state: "critical".

json

{
  "product": "grafana",
  "version": "10.0.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.35,
  "cve_ids": [
    "CVE-2023-4399",
    "CVE-2023-4822",
    "CVE-2023-6152",
    "CVE-2024-1442",
    "CVE-2025-12141",
    "CVE-2025-4123",
    "CVE-2026-21720",
    "CVE-2026-21722",
    "CVE-2026-21723",
    "CVE-2026-21727",
    "CVE-2026-27876",
    "CVE-2026-27877",
    "CVE-2026-27879",
    "CVE-2026-27880",
    "CVE-2026-28374",
    "CVE-2026-28375",
    "CVE-2026-28376",
    "CVE-2026-28379",
    "CVE-2026-28380",
    "CVE-2026-28383",
    "CVE-2026-33376",
    "CVE-2026-33377",
    "CVE-2026-33378",
    "CVE-2026-33381",
    "CVE-2026-42127",
    "CVE-2026-67342",
    "CVE-2026-72585"
  ],
  "cves": null,
  "max_epss": 0.98357,
  "last_updated": "2026-08-16T05:54:40.592858Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Grafana 11.3.0 sits past the CVE-2023-3128 Azure AD fix and the plugin path-traversal / snapshot exposure patches on earlier major lines.

bash

curl "https://api.attestd.io/v1/check?product=grafana&version=11.3.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Grafana CVE history spans unauthenticated path traversal via plugin URLs, snapshot permission failures, predictable session cookies on older majors, and OAuth or IdP claim mistakes that enable account takeover. Two entries below appear in the CISA KEV catalog.

CVE	Description	Affects	CVSS
`CVE-2018-15727`	Predictable remember-me cookie forges authenticated sessions.	Grafana 2.x to 5.x	9.8
`CVE-2023-3128`	Azure AD email-claim account takeover via a non-unique modifiable email.	≥6.7 / 8.5 / 9.x	9.8
`CVE-2021-43798`KEV	Path traversal on plugin URL reads arbitrary files from the Grafana host.	8.0.0-beta1 to 8.3.0	7.5
`CVE-2021-39226`KEV	Snapshot permission check failure exposes snapshots to unauthenticated viewers.	<7.5.11 / ≥8.0.0 <8.1.6	7.3

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Grafana CPE namespace

NVD records Grafana under a single application CPE. Attestd maps the grafana product slug to that namespace and matches major-line semver ranges.

cpe:2.3:a:grafana:grafanaGrafana OSS and Enterprise core

Query the Grafana server version your instance reports. Plugin package names are not separate Attestd product slugs.

All products Zabbix Kibana Quickstart