Dashboard snapshot permission bypass

OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

SSO settings authorization bypass

Server-side expression parser denial of service

Azure Monitor access token disclosure via SSRF

Alerting contact point authorization bypass via schema downgrade

CVE-2026-16491 CVE Record

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Viewer role can create, modify and delete Loki alerting rules

Unbounded memory allocation in the Prometheus rule conversion API

Git Sync connection configuration can be modified with read-only access

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

Git Sync memory exhaustion via a malicious Git server

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Alert rules in restricted folders disclosed via the alert rules list API

Library panel can be moved into a folder without library panel create permission

Paused shared dashboard access tokens still expose data source configuration

CVE-2026-15815 CVE Record

CVE-2026-76154 CVE Record

Session takeover via Auth Proxy cache key collision

SAML assertion replay via skipped InResponseTo validation

SQL Data Source Plugin: OOM DoS via $__timeGroup macro

Broken access control in dashboard snapshots

CVE-2026-17033 CVE Record

CVE-2026-17183 CVE Record

CVE-2026-11817 CVE Record

CVE-2026-21723 Record

Stored XSS in the table panel (TableNG)

Pre-authentication denial of service via the OAuth login route

Denial of service via unbounded request body size